Critical Vulnerabilities Discovered in Google Chrome and Arm GPU Drivers

Florian Schweitzer, Security Researcher at Certitude Consulting, has identified two serious vulnerabilities in products from Google and Arm that affect the same attack vector in the GPU software stack used by modern web browsers and mobile devices (CVE-2026-9034 and CVE-2026-93374). The issue can be triggered via JavaScript and could enable a sandbox escape. Such vulnerabilities could allow an attacker to compromise a user’s device after they visit a website.

The discovery comes at a time of significant changes in vulnerability research, driven by the increasing use of artificial intelligence.

The starting point for Schweitzer’s research was a deliberate decision not to compete with the enormous computing resources already being used to identify vulnerabilities in Chrome.

“My strategy was simple: If you can’t compete with Google’s computing resources, you shouldn’t even try. I wanted to find attack surfaces that are difficult to integrate into a fuzzer or a fully automated AI workflow: real devices, stateful behavior, and boundaries between systems,” Schweitzer explained.

Nevertheless, Schweitzer made extensive use of AI to generate WebGPU workloads, create automated test harnesses and device instrumentation, modify and compile Chromium, process crash data, and assist with reverse engineering the proprietary GPU driver. Rather than treating the model’s conclusions as definitive answers, he followed a process inspired by Austrian philosopher Karl Popper: formulating competing hypotheses, turning them into experiments, and attempting to falsify them as early and cost-effectively as possible.

“The economics become interesting when the cost of failure decreases. If a hypothesis that would previously have taken several weeks to test can now be tested and discarded within a few hours, security researchers can conduct significantly more experiments. The competitive advantage increasingly lies in deciding which questions are worth asking, which evidence can be trusted, and which results warrant another hour of investigation,” said Marc Nimmerrichter, Managing Partner at Certitude Consulting.

Critical Chrome Vulnerabilities Compared: 2025 and 2026

Certitude’s analysis of Google’s public Chrome Stable security releases shows that only four critical Chrome vulnerabilities were fixed in 2025. Three of these were reported by external security researchers, while one was attributed to Google.

As of September 17, 2026, the same public data lists 179 critical vulnerabilities fixed in 2026: 145 attributed to Google and 34 to external researchers. External researchers have therefore already contributed more than ten times as many critical findings as in the previous year. At the same time, the number of critical findings attributed internally to Google has increased from one in 2025 to 145 in 2026.

This shift coincides with Google’s rapid expansion of AI use in security research. In July, the Chrome Security Team described this as a “massive shift in the software security industry” and explained that large language models enable automated vulnerability discovery on a scale beyond traditional human research. Google states that it now uses AI throughout the entire vulnerability lifecycle, including vulnerability discovery, reproduction, triage, and remediation.

The first vulnerability reported by Schweitzer, CVE-2026-9034, affects the Arm Mali GPU userspace driver. According to the public security advisory, an unprivileged process executing valid GPU operations “via WebGL or WebGPU” could access previously freed memory. The vulnerability affects several generations of Arm GPU drivers, including the 5th Gen GPU architecture, which provides graphics and compute capabilities for a wide range of consumer devices, including smartphones, tablets, TVs, and wearables.

The second vulnerability, CVE-2026-93374, affects Google Chrome. Google classifies it as critical and describes it as a “use after free in Dawn,” Chromium’s implementation of WebGPU. The public CVE description identifies the issue as remotely exploitable via a crafted HTML page and as a potential sandbox escape: “Use after free in Dawn in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)”

Potential Sandbox Escape

The Chrome sandbox is a key security boundary designed to restrict access to the underlying operating system by exposed browser components responsible for rendering websites. Vulnerabilities that can bypass this boundary are therefore particularly dangerous. Exploit code can be delivered via a link to a website.

Google credits Florian Schweitzer with reporting the Chrome vulnerability on April 8, 2026. Arm also publicly names Schweitzer of Certitude Consulting as the discoverer of CVE-2026-9034.

Detailed technical information is intentionally being withheld during the coordinated disclosure process to avoid providing information that could enable exploitation before affected systems are adequately protected. Further details will be published at an appropriate time.

Public References

Arm Security Advisory: CVE-2026-9034, September 8, 2026
https://support.arm.com/documentation/111552/1-0/?lang=en

NIST NVD: CVE-2026-9034
https://nvd.nist.gov/vuln/detail/cve-2026-9034

Google Chrome Security Announcement: CVE-2026-93374, September 17, 2026
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html

NIST NVD: CVE-2026-93374
https://nvd.nist.gov/vuln/detail/cve-2026-93374