Search CVEs, research… / diras.sa
  • PoC PUBLIC
  • PATCH AVAILABLE

CVE-2026-76036: remote code execution in Google Chrome

Remote attackers can execute arbitrary code in Google Chrome on Android by convincing a user to load a malicious page; this is tracked as CVE-2026-76036. The flaw is a buffer overflow in the Dawn component and affects Chrome 151.0.7922.169 and earlier on the 151.x branch; an attacker needs a crafted HTML page and user interaction (a visit/click) to trigger it.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.6CRITICAL
EPSS
0.00506
CWE
CWE-122
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Urgent: patch immediately — public exploit code exists and the issue is fixed in Chrome 151.0.7922.169. Prioritize updating Android Chrome clients that remain on the 151.x branch and restrict exposure until patched.

What is CVE-2026-76036?

Remote attackers can execute arbitrary code in Google Chrome on Android by convincing a user to load a malicious page; this is tracked as CVE-2026-76036. The flaw is a buffer overflow in the Dawn component and affects Chrome 151.0.7922.169 and earlier on the 151.x branch; an attacker needs a crafted HTML page and user interaction (a visit/click) to trigger it. The weakness is classified as CWE-122 (Heap-based Buffer Overflow).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Which versions of Google Chrome are affected?

BRANCHAFFECTEDFIXED
151.x151.0.7922.169 – before 151.0.7922.169151.0.7922.169

Is CVE-2026-76036 being exploited?

Public exploit code is available.

How to fix CVE-2026-76036

  1. Update Chrome on affected Android devices to 151.0.7922.169.
  2. If immediate update is impossible, restrict access to untrusted web content and block risky page rendering where feasible.
  3. Monitor browser crash and security logs for suspicious renderer crashes or unexpected process terminations.
  4. Apply vendor guidance and run endpoint detection for indicators of compromise related to crafted HTML payloads.

Frequently asked questions

Is CVE-2026-76036 being actively exploited?

Public exploit code is available for CVE-2026-76036, indicating a heightened risk of active exploitation.

Which Chrome versions are affected by CVE-2026-76036?

Chrome on Android in the 151.x branch is affected; specifically versions before 151.0.7922.169 are vulnerable.

Is there a patch for CVE-2026-76036?

Yes. Google fixed the vulnerability in Chrome version 151.0.7922.169 on the 151.x branch.

Does CVE-2026-76036 require authentication?

No authentication is required; an attacker only needs to get a user to load a crafted HTML page in the vulnerable Chrome on Android.

References