CVE-2026-84333 Google CVE debrief

Who should care

Users of Google Chrome on Android, IT administrators responsible for managing Chrome deployments, security teams monitoring for potential threats, and operators of Android devices using Chrome for browsing. These stakeholders should assess their exposure and prioritize patching to prevent potential code execution attacks. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Operators of Android devices should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Vulnerability management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Asset inventory managers should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should also consider the operational impact of this vulnerability and prioritize patching accordingly. The use-after-free vulnerability in Dawn within Google Chrome on Android prior to 152.0.7977.75 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This issue is particularly concerning due to its critical severity rating and the potential for significant impact on affected systems. Users and IT administrators responsible for managing Chrome deployments should assess their exposure and prioritize patching to prevent potential code execution attacks. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Operators of Android devices should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Vulnerability management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Asset inventory managers should review the supplied official advisory or CVE record to and

Technical summary

The use-after-free vulnerability in Dawn within Google Chrome on Android prior to 152.0.7977.75 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This issue is particularly concerning due to its critical severity rating and the potential for significant impact on affected systems. Users and IT administrators responsible for managing Chrome deployments should assess their exposure and prioritize patching to prevent potential code execution attacks.

Defensive priority

High priority due to critical severity and potential for arbitrary code execution.

Recommended defensive actions

• Apply patch to update Google Chrome to version 152.0.7977.75 or later
• Restrict access to untrusted sources
• Monitor for suspicious activity

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates a use-after-free vulnerability in Dawn in Google Chrome on Android prior to 152.0.7977.75. Limited information available on affected scope and vendor remediation. Further review of Chrome release notes and security advisories is recommended to understand the full impact and necessary mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.