EUVD-2026-34615
GHSA-p4p7-pc96-m757
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free in the Dawn WebGPU implementation, enabling a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), though Google has released a stable channel update addressing the flaw.
Technical ContextAI
Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing GPU-accelerated graphics and compute capabilities to web content by translating WebGPU calls into native graphics APIs (Vulkan, Metal, D3D12). The root cause is CWE-416 (Use After Free), in which memory is referenced after it has been released back to the allocator - typically due to mismatched object lifetime management between the renderer process and the GPU process. Because Dawn handles untrusted GPU command streams that cross the renderer/GPU process boundary, a UAF in this component is particularly dangerous as it sits at the sandbox perimeter where renderer-supplied data is parsed by a more privileged process.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; on managed fleets verify auto-update is functioning and force-relaunch browsers to apply the fix. Administrators of downstream Chromium forks (Edge, Brave, Opera, Electron apps) should track their respective vendor advisories and update once rebased builds ship. As an interim compensating control where patching is delayed, WebGPU can be disabled via the chrome://flags/#enable-unsafe-webgpu toggle or the WebGPU enterprise policy, which removes the attack surface entirely at the cost of breaking sites and apps that depend on WebGPU acceleration (increasingly common in 3D, ML inference, and creative tooling). Restricting Chrome's exposure to untrusted sites via site isolation policies and URL allowlists is a partial mitigation but does not address malvertising or compromised legitimate sites.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today