CVE-2026-121247

Summary

A heap-based buffer overflow in Google Chrome's Dawn WebGPU implementation on Android prior to version 157.0.8103.38 allowed remote attackers to execute arbitrary code outside the sandbox via a malicious HTML page, leveraging user interaction.

Exploitability

Exploitation requires a user to visit a crafted HTML page and interact with it (e.g., by triggering WebGPU usage), but otherwise needs no privileges or local access.

Blast radius

Successful exploitation could lead to full system compromise outside Chrome's sandbox, enabling data theft, malware installation, or lateral movement on the device.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome for Android to version 157.0.8103.38 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.