hunt-benito/rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-androidDifferential detection harness for CVE-2026-76036, a Dawn WebGPU heap buffer overflow in Chrome on Android. Probes vulnerable depth/stencil texture combinations and monitors GPU-process crashes to classify browser and GPU exposure.
Critical (CVSS 9.6, CWE-122) heap buffer overflow in Dawn, Chromium's WebGPU implementation, in Google Chrome on Android prior to 151.0.7922.169 (stable 151, released 2026-08-18).
Root cause, per Dawn fix commit
178fb7048ad3: the
PowerVR proprietary Vulkan driver miscomputes mip-level sizes for
non-power-of-two (NPOT) depth/stencil textures. A web page calling
device.createTexture() with a depth/stencil format, NPOT dimensions, and
mipLevelCount > 1 on affected hardware corrupts the GPU-process heap.
NVD: "allowed a remote attacker to execute arbitrary code outside the sandbox
via a crafted HTML page".
The exact trigger sits in restricted Chromium bug 540087398. This repo therefore ships a differential detection harness, not an exploit: it enumerates the combination named by the public fix commit and classifies your browser+GPU.
| File | Purpose |
|---|---|
poc.html | WebGPU probe matrix — all five depth/stencil formats × NPOT sizes (incl. the 259×127 shape from Dawn's suppressed end2end test) × mip counts, each in its own validation error scope |
crash_monitor.py | adb companion — pins the installed Chrome version vs. the 151.0.7922.169 floor and tails logcat for GPU-process fatal signals |
# 1) serve the harness (WebGPU needs a secure context: localhost or HTTPS)
$ python3 -m http.server 8000
# 2) on the device (or desktop Chrome), open:
# http://<your-host>:8000/poc.html (localhost/http works; remote hosts need HTTPS)
# 3) from a host with adb, watch the GPU process:
$ python3 crash_monitor.py
[*] com.android.chrome versionName=151.0.7922.83
[!] VULNERABLE — below the 151.0.7922.169 fix floor (CVE-2026-76036)
[*] logcat: live tail — Ctrl-C to stop. Load poc.html on the device now.
poc.htmlThe harness throttles each probe (~150 ms) so a lab device survives long enough to produce a verdict instead of dying on the first divergent copy.
Run only against devices and browsers you own or administer. On unpatched, affected hardware the underlying bug is a genuine memory-corruption trigger; the harness deliberately avoids any attempt to shape that corruption.
| Observation | Meaning |
|---|
| Validation error containing "disallowed on this device due to a driver bug" | Fix active + GPU is in the affected PowerVR class (device was reachable pre-patch; confirm version ≥ 151.0.7922.169) |
| Combinations accepted, no such error | GPU outside the affected Imagination class — not reachable via this path |
device.lost fires mid-sweep / GPU-process Fatal signal in logcat on Chrome < 151.0.7922.169 | Pre-patch behavior this CVE exists to remove — update immediately |
navigator.gpu undefined | WebGPU unavailable — surface closed |