CVE-2026-76036
published 2026-08-18CVE-2026-76036: Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a…
PriorityP353critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.51%
41.6th percentile
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 151.0.7922.169 | 151.0.7922.169 | |
| chrome | >= 151.0.7922.169 < 151.0.7922.169 | 151.0.7922.169 | |
| chrome_desktop | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Chrome up to 151.0.7922.137 Dawn buffer overflow (EUVD-2026-61224 / Nessus ID 338835)
vuldb·2026-08-23·CVSS 9.6
CVE-2026-76036 [CRITICAL] Google Chrome up to 151.0.7922.137 Dawn buffer overflow (EUVD-2026-61224 / Nessus ID 338835)
A vulnerability was found in Google Chrome and classified as critical. This affects an unknown part of the component Dawn. Such manipulation leads to buffer overflow.
This vulnerability is documented as CVE-2026-76036. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-08-18
CVE-2026-76036 [CRITICAL] CWE-122 Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Chrome
Stable Channel Update for Desktop: CVE-2026-76034
vendor_chrome·2026-08-18
CVE-2026-76034 [CRITICAL] Stable Channel Update for Desktop: CVE-2026-76034
Stable Channel Update for Desktop
CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15 [N/A][ 540087398 ] Critical CVE-2026-76036: Buffer overflow in Dawn
Reported by Google on 2026-07-28 [N/A][ 516715010 ] High CVE-2026-76033: Inappropriate implementation in CORS
Severity: critical
Red Hat
chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
vendor_redhat·2026-08-18·CVSS 9.6
CVE-2026-76036 [CRITICAL] CWE-120 chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
A flaw was found in Dawn in Google Chrome on Android. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page.
Statement: This Important flaw in Dawn, as used in Chromium-based browsers, allows a remote attacker to execute arbitrary code outside the browser's sandbox. This occurs when a user visits a specially crafted HTML page, leading to a buffer overflow.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
blogs_hackernews·2026-08-24
CVE-2026-19478 ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.
That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.
Plenty to clean up. Here’s the short version.
## ⚡ Threat of the Week
U.S. Warns of AI-Powered Attacks on Siemens PLCs — Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series program
Bugzilla
CVE-2026-76036 chromium: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page [fedora-all]
bugzilla·2026-08-19·CVSS 9.6
CVE-2026-76036 [CRITICAL] CVE-2026-76036 chromium: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page [fedora-all]
CVE-2026-76036 chromium: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Bugzilla
CVE-2026-76036 chromium: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page [epel-all]
bugzilla·2026-08-19·CVSS 9.6
CVE-2026-76036 [CRITICAL] CVE-2026-76036 chromium: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page [epel-all]
CVE-2026-76036 chromium: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Bugzilla
CVE-2026-76036 chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
bugzilla·2026-08-18·CVSS 9.6
CVE-2026-76036 [CRITICAL] CVE-2026-76036 chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
CVE-2026-76036 chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
2026-08-18
Published