CVE-2026-84333: 
vulnerability analysis and mitigation

CVE-2026-84333 is a use-after-free vulnerability in the Dawn graphics component of Google Chrome on Android that allows a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. It affects all versions of Google Chrome prior to 152.0.7977.75 on Android. The vulnerability was reported by Google on 2026-08-19 and publicly disclosed on 2026-09-01 with the release of Chrome 152.0.7977.75. It carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Chrome Releases).

The vulnerability is classified as CWE-416 (Use After Free), occurring in Dawn — Chrome's cross-platform graphics abstraction layer used for WebGPU. A use-after-free condition arises when memory associated with a Dawn object is freed but a dangling pointer to that memory is subsequently dereferenced, allowing an attacker to control the freed memory region and redirect execution flow. Exploitation requires a user to visit a specially crafted HTML page, after which the attacker can achieve code execution outside the Chrome sandbox — a particularly severe outcome given Chrome's multi-process security model. The Chromium issue tracker entry is available at https://issues.chromium.org/issues/549311485, though access may be restricted pending broad user patching (GitHub Advisory, Chrome Releases).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code outside the Chrome sandbox on an affected Android device, resulting in high confidentiality, integrity, and availability impact. Because code execution escapes the sandbox, an attacker could access sensitive data stored on the device, install malware, or pivot to other device resources beyond the browser's security boundary. The changed scope (S:C) in the CVSS vector reflects this sandbox escape, making the real-world impact significantly broader than a typical browser memory corruption bug (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.25–0.28%, placing it in the 21st percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (visiting a malicious page), which somewhat limits opportunistic mass exploitation, though drive-by attack scenarios remain realistic (GitHub Advisory).

1. Reconnaissance: Identify Android users running Google Chrome versions prior to 152.0.7977.75 as potential targets.
2. Craft malicious HTML page: Develop a specially crafted HTML page that triggers the use-after-free condition in Chrome's Dawn graphics component, for example by manipulating WebGPU API calls to cause a Dawn object to be freed while a reference to it remains accessible.
3. Deliver the payload: Host the malicious page on an attacker-controlled server and lure the target into visiting it via phishing, malvertising, or a compromised website link.
4. Trigger the vulnerability: When the victim loads the page in Chrome on Android, the crafted JavaScript/WebGPU operations trigger the use-after-free, allowing the attacker to corrupt heap memory and gain control of execution flow.
5. Achieve sandbox escape: Leverage the memory corruption to redirect execution outside the Chrome renderer sandbox, enabling arbitrary code execution at the OS level on the Android device (Chrome Releases, GitHub Advisory).

Google has released a patch in Chrome version 152.0.7977.75 (Linux) and 152.0.7977.75/.76 (Windows/Mac), with the Android fix specifically addressing this vulnerability. Users should update Google Chrome on Android to version 152.0.7977.75 or later immediately via the Google Play Store. As an interim measure, users should avoid visiting untrusted websites or clicking links from unknown sources. Organizations unable to patch immediately should consider restricting Chrome usage or deploying mobile device management (MDM) policies to enforce browser version controls (Chrome Releases, Microsoft MSRC).

The vulnerability was covered by multiple cybersecurity news outlets as part of broader reporting on the Chrome 152 security update, which addressed 26 total vulnerabilities including two Critical-rated use-after-free flaws. Coverage from CyberSecurityNews, GBHackers, and CyberPress highlighted the significance of the sandbox escape capability. The CIS also issued an advisory noting that multiple vulnerabilities in Google Chrome could allow for arbitrary code execution (CIS Advisory). Community reaction was measured, with no extraordinary alarm given the absence of active exploitation.