CVE-2026-84333 in Chrome
Summary
by MITRE • 09/02/2026
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as a use-after-free flaw within Google Chrome's Dawn graphics engine on Android represents a critical memory safety issue that compromises the integrity of the browser's execution environment. This defect, present in versions prior to 152.0.7977.75, stems from improper management of object lifecycles during GPU command processing or shader compilation operations handled by the Dawn library. When an application allocates memory for a graphics-related object and subsequently frees that memory while retaining one or more pointers to it, any subsequent access through those dangling pointers results in undefined behavior. In this specific context, the flaw allows data from previously freed objects to be interpreted as executable code or control structures because the underlying memory may have been reallocated for different purposes by other processes or internal browser components.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a crafted HTML page. An attacker can construct a malicious web page containing specific JavaScript and WebGL commands that trigger the race condition or logic error leading to the use-after-free state within Dawn. By carefully crafting the payload, an adversary can manipulate memory layout to achieve arbitrary code execution outside of Chrome's sandboxing mechanisms. This bypass is particularly dangerous as it allows malware to gain elevated privileges on the Android device, potentially leading to full system compromise, data exfiltration, or installation of persistent backdoors without user interaction beyond visiting the malicious site.
From a classification perspective, this vulnerability aligns with CWE-416, which describes Use After Free errors where memory is accessed after it has been freed. The exploitation technique maps directly to MITRE ATT&CK techniques related to sandbox escape and arbitrary code execution, specifically leveraging browser vulnerabilities to break out of restricted environments. Such attacks are often categorized under initial access vectors in threat modeling exercises because they require no prior authentication or physical access, relying solely on social engineering through web delivery mechanisms like phishing links or compromised websites hosting the exploit kit.
Mitigation strategies primarily involve immediate patching by updating Google Chrome and its underlying Chromium components to version 152.0.7977.75 or later where these memory management issues have been resolved. Developers should also ensure that their Android devices receive all available security updates, as system-level patches often include hardened versions of the browser engine. For organizations deploying managed browsers, enforcing strict content security policies and restricting WebGL capabilities in high-risk environments can reduce the attack surface. Additionally, enabling Chrome's built-in sandboxing features and keeping them active ensures that even if a vulnerability is exploited, the potential damage to the host operating system is contained within isolated processes rather than allowing direct kernel or application-level access.