CVE-2026-93374 in Chrome
Summary
by MITRE • 09/18/2026
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified as a use-after-free flaw within Google Chrome's Dawn graphics engine on Android represents a critical security risk that allows for potential arbitrary code execution with elevated privileges. This specific defect resides in the implementation of Dawn, which is Chromium’s abstraction layer over low-level graphics APIs such as Vulkan and OpenGL ES. The core technical issue involves memory management where an object is deallocated but remains accessible through dangling pointers within the rendering pipeline. When a remote attacker crafts a malicious HTML page that triggers this sequence during GPU command processing or shader execution, the browser fails to properly invalidate references to the freed memory block. This lapse permits the application of data overwrites or control flow hijacking techniques against the heap structure used by the graphics subsystem.
From an operational perspective, the exploitation of this vulnerability enables a remote attacker to bypass Chrome’s sandboxing mechanisms which are designed to isolate web content from the underlying operating system and user files. By leveraging the use-after-free condition within Dawn, an attacker can achieve arbitrary read and write access to memory regions that should be restricted. This capability is particularly dangerous because it allows code execution outside the confined browser environment, potentially leading to full device compromise on Android devices running versions prior to 153.0.8010.52. The severity of this issue is classified as critical due to its remote exploitability and the high likelihood of successful exploitation given the complexity of modern web applications that utilize WebGL or WebGPU for rendering intensive content.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes use after free errors where a pointer continues to point at memory that has been freed, leading to undefined behavior and potential security breaches. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with initial access and privilege escalation, specifically allowing attackers to execute arbitrary code in a context higher than intended by the sandbox policy. The attack vector is classified as remote via network, meaning no user interaction beyond visiting a malicious webpage or loading specific web content is required for exploitation.
Mitigation strategies primarily involve updating Google Chrome on Android devices to version 153.0.8010.52 or later where these memory management issues have been addressed by the Chromium security team. Developers integrating WebGL or WebGPU should ensure they are using updated browser engines and consider implementing strict content security policies to limit script execution from untrusted sources. Additionally, enabling hardware-based sandboxing features on Android devices can provide an additional layer of defense against exploitation attempts that might bypass software-level mitigations. Continuous monitoring for anomalous GPU resource usage patterns may also aid in detecting potential exploitation activities in enterprise environments.