Loading vulnerability…
Dawn Use-After-Free in Google Chrome for Android
CVE-2026-87520 is a use-after-free vulnerability in the Dawn component of Google Chrome for Android before version 153.0.8010.36. A remote attacker can trigger the vulnerability through a crafted HTML page and execute arbitrary code outside the browser sandbox. Chromium classifies the vulnerability as High severity. The affected function and precise memory-lifetime error are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution outside the Chrome sandbox, bypassing its isolation boundary. This can compromise the confidentiality, integrity, and availability of resources accessible to the compromised execution context. The vulnerability does not establish root-level access or a specific operating-system privilege level.
If you can’t patch tonight, do this now.
Until the update is deployed, restrict use of affected Chrome installations for untrusted web content and apply network or web filtering to reduce exposure to malicious pages. These measures reduce exposure but do not correct the vulnerability; no complete workaround is identified.
Patch, then assume compromise.
Update Google Chrome for Android to version 153.0.8010.36 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.