EUVD-2026-34376
GHSA-w2x6-xcgf-jr36
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 can be achieved by remote attackers who have already compromised the renderer process, leveraging an out-of-bounds read in the Dawn WebGPU implementation via a crafted HTML page. Google rates this as High severity and a vendor patch is available, though no public exploit has been identified at time of analysis. The bug is part of a multi-stage exploitation chain rather than a single-step RCE, but successful chaining yields full escape from Chrome's renderer sandbox.
Technical ContextAI
Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing GPU access to web content through a unified abstraction over Direct3D, Metal, and Vulkan backends. The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety class where the code reads beyond the bounds of an allocated buffer, which in the context of a GPU command/buffer handler can leak adjacent memory contents or corrupt control-flow data used by the GPU process. Because Dawn code historically runs in the more-privileged GPU process boundary, an OOB read triggered from renderer-supplied WebGPU commands can be abused to disclose pointers or state needed to defeat sandbox isolation, enabling escape from the renderer sandbox into a higher-privilege context.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked under https://issues.chromium.org/issues/500090141; managed environments should force-restart Chrome to ensure the new binary loads. For Chromium-based browsers, install the corresponding vendor update once available. As a temporary compensating control where patching is delayed, disable WebGPU via the chrome://flags/#enable-unsafe-webgpu setting or the WebGPU enterprise policy, which removes the Dawn attack surface at the cost of breaking WebGPU-dependent sites and applications; restricting use of untrusted web content and enabling Site Isolation (default) further limits the value of a renderer compromise needed to reach this bug.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today