EUVD-2026-105429
GHSA-p27c-3g6v-cc5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage issues malicious WebGPU/Dawn calls
-
ExecutionTrigger out-of-bounds read in Dawn
-
ImpactLeak sandbox memory to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Chrome that exercises the Dawn WebGPU backend (UI:R - the user must visit a crafted HTML page), and the affected Chrome build must be earlier than 156.0.8078.47. WebGPU/Dawn is enabled by default in modern Chrome, so no special configuration is generally needed. Limiting factors: success yields only an out-of-bounds read confined within the sandbox (C:H, I:N, A:N) - no code execution or sandbox escape by itself - and the required user interaction plus the already-released fix meaningfully reduce real-world exposure. |
| Impact | Signals converge on a genuine-but-moderate priority. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a remote, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted HTML page) and yields confidentiality-only impact - an out-of-bounds read of memory inside the sandbox, not sandbox escape or code execution. EPSS is low (0.23%, 13th percentile), consistent with no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent widespread exploitation. The Chromium 'High' severity rating reflects the memory-safety bug class and Chrome's ubiquity rather than a weaponized threat. No SSVC decision data was supplied. One tension worth noting: this is an information-disclosure primitive (C:H, I:N, A:N) that in practice is frequently chained with other bugs to defeat ASLR or stage a sandbox escape, so the standalone 6.5 understates its value as a building block. Net: patch on normal cadence - not an emergency, but Chrome's deployment footprint means it should not be deferred. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing content that drives Chrome's Dawn (WebGPU) implementation into a memory-corruption condition. When a victim visits the page, the flaw lets the attacker read out-of-bounds memory within the sandbox, potentially leaking sensitive data or address-layout information useful for chaining further exploitation. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An out-of-bounds memory read in Chrome's Dawn WebGPU implementation (CVE-2026-113322) lets a remote attacker who convinces a victim to open a crafted HTML page read memory inside the renderer sandbox. Only Chrome builds earlier than 156.0.8078.47 are affected, and exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), with impact limited to confidentiality - no memory write, code execution, or sandbox escape is described. At time of analysis there is no confirmed active exploitation and no public exploit code identified, and EPSS is low at 0.23% (13th percentile); a vendor patch is already available, which materially reduces real-world exposure.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later via the stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html), and apply the corresponding ChromeOS stable update (http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01150416531.html) on managed Chromebooks; note that Chrome typically stages updates on restart, so verify the reported version at chrome://version and fully relaunch the browser rather than relying on a background download. Until fleet-wide patching completes, the most direct compensating control is to disable WebGPU for untrusted content - via the enterprise policy/flag controlling WebGPU availability or by launching Chrome with the WebGPU feature disabled - accepting the trade-off that GPU-accelerated web applications and some 3D/canvas workloads will lose hardware acceleration or fall back to slower paths. Because the vulnerability requires the victim to load a crafted page and yields only an in-sandbox read, additional containment can come from restricting browsing of untrusted links to a disposable or heavily isolated profile, and from keeping renderer sandboxing and site isolation enabled (do not relax them for convenience). No public exploit code was identified at time of analysis and EPSS is low, so emergency out-of-band measures beyond standard patch cadence are not indicated, but prioritizing updates for users who routinely visit untrusted or user-supplied web content remains prudent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is the cross-platform C++ implementation of the WebGPU standard that ships inside Chrome and exposes GPU functionality to web content. The flaw is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer), and in this case manifests as an out-of-bounds read reachable through the WebGPU backend rather than a write. Because WebGPU/Dawn is enabled by default in current Chrome builds, no special configuration is generally needed to reach the vulnerable code path - the attacker only needs the victim to load attacker-controlled HTML that exercises Dawn. The read is confined to the sandboxed renderer process (scope unchanged, C:H/I:N/A:N), so by itself it yields information disclosure inside the sandbox rather than code execution or a sandbox escape; chaining with a separate sandbox-escape primitive would be required for greater impact. The issue was reported through Google's Chrome CVE administration process and is tracked in the Chromium issue tracker (issues.chromium.org/issues/536639352), with an EUVD record (EUVD-2026-105429) mirroring the Chrome 156.0.8078.47 fix threshold.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page needs no privileges (PR:N) but requires the victim to visit it (UI:R); impact is an in-sandbox memory read, so C:H with I:N/A:N and no scope change.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB