CVE-2026-95283 in Chrome
Summary
by MITRE • 09/29/2026
Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-2024-6925 represents a critical memory safety flaw within the Tint shader compiler component of Google Chrome on Android, specifically affecting versions prior to 154.0.8037.57. This issue stems from improper handling of input data during the compilation and optimization phases of graphics shaders written in GLSL or similar shading languages. When a remote attacker crafts an HTML page containing maliciously constructed shader code that triggers specific edge cases within Tint, it leads to a buffer overflow condition. The root cause lies in insufficient bounds checking when allocating memory for intermediate representation structures or processing instruction operands, allowing the application to write data beyond the allocated buffer boundaries. This type of flaw is classically categorized under CWE-120 Buffer Copy without Checking Size of Input and often involves CWE-787 Out-of-bounds Write depending on the specific execution path triggered by the malformed input.
The operational impact of this vulnerability is severe due to its potential for remote code execution outside the browser's sandbox environment. Chrome relies heavily on a multi-process architecture with strict sandboxes to isolate web content from the underlying operating system and user data. However, graphics processing units and their associated compilers often operate in contexts where memory isolation boundaries can be more complex or less strictly enforced compared to standard JavaScript engines. By exploiting this buffer overflow, an attacker could potentially corrupt adjacent memory structures such as function pointers, return addresses, or object headers within the Tint process. This corruption allows for arbitrary code execution with the privileges of the compromised browser process. If the sandbox boundaries are successfully bypassed through additional exploitation techniques leveraging this initial foothold, the attacker gains control over the Android device, leading to full system compromise including access to sensitive user data, installation of persistent malware, or use of the device in a botnet.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1203 Exploitation for Client Execution and potentially T1059 Command and Scripting Interpreter if shellcode is deployed to execute further payloads. The attack vector requires user interaction in the form of visiting a maliciously crafted website or opening an email attachment containing such content, which classifies it under Initial Access tactics involving Spearphishing Link or Drive-by Compromise. The high severity rating assigned by Chromium security reflects the ease with which memory corruption can be leveraged to achieve code execution and the critical nature of maintaining browser integrity on mobile platforms where users often store significant personal and financial information.
Mitigation strategies primarily involve immediate software updates to ensure that all Android devices running Google Chrome are upgraded to version 154.0.8037.57 or later, which contains patches for this memory safety issue. Developers integrating similar graphics compilation libraries should enforce strict input validation and implement safe string handling practices to prevent buffer overflows during shader parsing. Additionally, enabling advanced security features such as Memory Protection Extensions on supported Android hardware can help mitigate the impact of exploitation attempts by making it more difficult to execute injected code in non-executable memory regions. Continuous monitoring for anomalous behavior in browser processes and keeping operating system level protections like SELinux policies up to date further reduces the attack surface available to adversaries attempting to leverage such vulnerabilities.