CVE-2026-76036
Description
A flaw was found in Dawn in Google Chrome on Android. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page.
Statement
This Important flaw in Dawn, as used in Chromium-based browsers, allows a remote attacker to execute arbitrary code outside the browser's sandbox. This occurs when a user visits a specially crafted HTML page, leading to a buffer overflow. The impact is significant due to the potential for arbitrary code execution, even though user interaction is required.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
