Loading story…
Certitude Consulting researcher Florian Schweitzer disclosed two use-after-free vulnerabilities in GPU software: CVE-2026-9034 in Arm Mali GPU userspace drivers and CVE-2026-93374 in Chrome’s Dawn WebGPU implementation. The Arm flaw lets an unprivileged process access freed memory while performing valid WebGL or WebGPU operations. According to Certitude, the critical Dawn flaw affects Chrome for Android versions before 153.0.8010.52 and could enable remote code execution outside the sandbox through a crafted HTML page. Technical exploitation details are being withheld during coordinated disclosure.
Google’s desktop Chrome release fixes the Dawn vulnerability alongside 15 other security issues, including the critical WebGL buffer overflow CVE-2026-93372 and high-severity flaws in Tracing, PDFium, Skia, Extensions, ORB, and V8. The patched desktop versions are 153.0.8010.52/.53 for Windows and macOS and 153.0.8010.52 for Linux. Security teams should verify Chrome updates across desktop and Android fleets and seek affected-version and remediation guidance from vendors supplying Arm Mali drivers. Google’s release notice does not report active exploitation, and the supplied disclosures do not specify an Arm driver fix version.
See affected versions and whether adversaries are exploiting it.
19 events from the most recent confirmed update back to the earliest known activity.
Certitude Consulting researcher Florian Schweitzer discovered CVE-2026-9034 in Arm Mali GPU userspace drivers and CVE-2026-93374 in Chrome’s Dawn WebGPU implementation. Both affect the GPU software stack and can be triggered through browser-accessible GPU operations.
Google announced Chrome Stable 153.0.8010.52/.53 for Windows and macOS and 153.0.8010.52 for Linux, fixing 16 vulnerabilities, including critical Dawn and WebGL flaws. Google said vulnerability details could remain restricted until users and dependent projects received fixes; the notice did not report active exploitation.
Google reported a high-severity type-confusion vulnerability in V8.
OGINOME Tomohito reported a high-severity incorrect-authorization vulnerability in Chrome’s ORB component.
Arm’s advisory describes a flaw allowing an unprivileged process executing valid WebGL or WebGPU operations to access previously freed memory. It affects multiple GPU driver generations, including the 5th Gen GPU architecture, and credits Florian Schweitzer with its discovery.
SeungMyung Lee and Siung Kim reported a high-severity buffer-overflow vulnerability in PDFium.
Google reported a medium-severity information-disclosure vulnerability in Chrome’s Paint component.
Google reported a high-severity use-after-free vulnerability in Chrome Extensions.
Google reported a high-severity improper-state-validation vulnerability in Skia.
M. Fauzan Wijaya, also known as Gh05t666nero, reported a high-severity incorrect-reference-resolution vulnerability in Chrome’s Tracing component.
Google reported a critical buffer-overflow vulnerability in Chrome’s WebGL implementation.
WinD39, identified as Huynh Dinh Vu, reported a high-severity use-after-free vulnerability in PDFium.
Google reported a medium-severity missing-authorization vulnerability in Chrome’s Storage component.
Google reported a medium-severity out-of-bounds-read vulnerability in Chrome’s DataTransfer component.
Google reported a medium-severity information-disclosure vulnerability in Chrome’s Permissions component.
Google reported a low-severity UI-misrepresentation vulnerability in Chrome’s WebAppInstalls component.
Google reported a medium-severity server-side request forgery vulnerability in Chrome’s Omnibox component.
Florian Schweitzer reported a critical use-after-free vulnerability in Dawn. The public description states that a crafted HTML page could potentially allow a remote attacker to execute arbitrary code outside the Chrome sandbox.
Google reported a medium-severity race-condition vulnerability in Chrome’s FileSystem component.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a Chrome desktop stable-channel update to address 15 security issues, including two **critical** buffer overflow vulnerabilities that could let a remote attacker achieve arbitrary code execution outside the browser sandbox through a crafted HTML page. The flaws are tracked as `CVE-2026-76034` in **WebGL** and `CVE-2026-76036` in **Dawn**, the graphics library that implements the **WebGPU** standard, raising the risk that a user could be compromised simply by visiting a malicious or compromised website. The update brings Chrome to version **151.0.7922.169/.170** on Windows and macOS and **151.0.7922.169** on Linux. The patched vulnerabilities affect desktop Chrome across all three platforms, and the presence of sandbox-escape-capable browser bugs makes the release particularly urgent because successful exploitation could move execution from browser content directly onto the host system.
Aug 19, 2026
Google released a Chrome Stable channel update to fix 15 security issues, including the critical vulnerability **CVE-2026-76034** in **WebGL**. The flaw is a `CWE-122` buffer overflow affecting Chrome versions prior to **151.0.7922.169**, and Google said it could be triggered by malicious web content. The update was issued as **151.0.7922.169/.170** for Windows and macOS and **151.0.7922.169** for Linux, with rollout occurring gradually. According to the CVE record, **CVE-2026-76034** could let a remote attacker execute arbitrary code outside the browser sandbox by persuading a user to open a crafted HTML page. Google also disclosed a second critical buffer overflow, **CVE-2026-76036**, in **Dawn**, Chromium’s WebGPU implementation, but said detailed technical information and bug reports are being withheld until most users have installed the fixes to reduce the risk of weaponization through patch reverse engineering.
Aug 21, 2026
Google Chrome fixed two high-severity use-after-free vulnerabilities in the **Dawn** component, tracked as **`CVE-2026-5281`** and **`CVE-2026-5286`**, in versions prior to **`146.0.7680.178`**. Both flaws could let a remote attacker trigger **arbitrary code execution** via a crafted HTML page, with one advisory noting exploitation after compromise of the renderer process and the other describing user-driven page loading as the attack path. Both CVEs are classified as **`CWE-416`** and carry the same **CVSS v3.1** vector, **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability. The records were updated with severity details and references to Chrome release notes and Chromium issue tracker entries, underscoring the need for organizations to move Chrome deployments to **`146.0.7680.178`** or later.
Apr 1, 2026