Security readout for executives and security teams
Plain-English summary
A memory-safety flaw in Chrome’s Dawn graphics component could let an attacker run code beyond Chrome’s sandbox after an Android user opens a malicious HTML page. Successful exploitation could compromise data, applications, and device availability. The supplied record rates it CVSS 9.6, while Chromium classifies it High.
Executive priority
Treat this as an urgent Android browser update because exploitation could escape Chrome’s sandbox and achieve broad device impact. Accelerate deployment and verify coverage, but do not report active exploitation based on this bundle. Escalate unsupported or update-blocked devices for isolation or replacement.
Technical view
CVE-2026-84333 is a CWE-416 use-after-free in Dawn affecting Google Chrome on Android before 152.0.7977.75. A crafted HTML page can trigger arbitrary code execution outside the sandbox. The CVSS 3.1 vector indicates network delivery, low attack complexity, no privileges, required user interaction, changed scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Android devices running Chrome versions earlier than 152.0.7977.75 are potentially exposed when users visit attacker-controlled or compromised pages. The bundle does not identify affected operating-system versions, downstream Chromium browsers, configuration prerequisites, or whether managed devices update automatically.
Exploitation context
The supplied sources describe remote exploitation through crafted HTML and require user interaction. The CVE is not listed as KEV in the bundle, and no cited source confirms active exploitation, public proof-of-concept availability, or observed attacks. Absence from KEV does not establish that exploitation is impossible.
Researcher notes
The record identifies Dawn and CWE-416 but provides no root-cause detail, affected code path, exploit indicators, or patch commit. The supplied Google release reference is titled for desktop, while the CVE description specifies Android; confirm Android release guidance before treating that bulletin as deployment evidence. Avoid extending impact claims to other Chromium-based browsers without vendor confirmation.
Mitigation direction
- Update Chrome on Android to 152.0.7977.75 or later through an approved distribution channel.
- Prioritize managed devices that browse untrusted websites or handle sensitive business data.
- Enforce browser-version compliance and investigate devices that cannot receive the required release.
- Check current Google guidance for platform-specific rollout details or additional mitigations.
Validation and detection
- Inventory Chrome versions across Android devices and identify installations below 152.0.7977.75.
- Confirm the updated version after deployment, accounting for phased application-store rollouts.
- Verify managed-device policies prevent outdated Chrome installations from accessing sensitive services.
- Review security telemetry for suspicious browser crashes or post-browser execution; these signals are not proof of exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-84333 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H2.86CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.htmlCVE reference, Chrome
- https://issues.chromium.org/issues/549311485CVE reference, Chrome
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.