## https://sploitus.com/exploit?id=7F343D08-06CA-5E53-A922-E56B77B0C592
# CVE-2026-76036 — Dawn (WebGPU) NPOT Depth/Stencil Mipmap Detection Harness
Critical (CVSS 9.6, CWE-122) heap buffer overflow in **Dawn**, Chromium's WebGPU
implementation, in **Google Chrome on Android prior to 151.0.7922.169**
(stable 151, released 2026-08-18).
Root cause, per Dawn fix commit
[`178fb7048ad3`](https://dawn.googlesource.com/dawn/+/178fb7048ad3): the
**PowerVR proprietary Vulkan driver miscomputes mip-level sizes for
non-power-of-two (NPOT) depth/stencil textures**. A web page calling
`device.createTexture()` with a depth/stencil format, NPOT dimensions, and
`mipLevelCount > 1` on affected hardware corrupts the GPU-process heap.
NVD: *"allowed a remote attacker to execute arbitrary code outside the sandbox
via a crafted HTML page"*.
The exact trigger sits in restricted Chromium bug
[540087398](https://issues.chromium.org/issues/540087398). This repo therefore
ships a **differential detection harness**, not an exploit: it enumerates the
combination named by the public fix commit and classifies your browser+GPU.
## Files
| File | Purpose |
|---|---|
| `poc.html` | WebGPU probe matrix — all five depth/stencil formats × NPOT sizes (incl. the 259×127 shape from Dawn's suppressed end2end test) × mip counts, each in its own validation error scope |
| `crash_monitor.py` | adb companion — pins the installed Chrome version vs. the 151.0.7922.169 floor and tails logcat for GPU-process fatal signals |
## Usage
```bash
# 1) serve the harness (WebGPU needs a secure context: localhost or HTTPS)
$ python3 -m http.server 8000
# 2) on the device (or desktop Chrome), open:
# http://:8000/poc.html (localhost/http works; remote hosts need HTTPS)
# 3) from a host with adb, watch the GPU process:
$ python3 crash_monitor.py
[*] com.android.chrome versionName=151.0.7922.83
[!] VULNERABLE — below the 151.0.7922.169 fix floor (CVE-2026-76036)
[*] logcat: live tail — Ctrl-C to stop. Load poc.html on the device now.
```
## Interpreting `poc.html`
| Observation | Meaning |
|---|---|
| Validation error containing *"disallowed on this device due to a driver bug"* | **Fix active + GPU is in the affected PowerVR class** (device was reachable pre-patch; confirm version ≥ 151.0.7922.169) |
| Combinations accepted, no such error | GPU outside the affected Imagination class — not reachable via this path |
| `device.lost` fires mid-sweep / GPU-process `Fatal signal` in logcat on Chrome
- CVE:
- Chrome Releases (2026-08-18, stable 151.0.7922.169):
- Chrome for Android (2026-08-18):
- Dawn fix commit:
- Hunt-Benito write-up: