EUVD-2026-41175
GHSA-g9cr-jqjw-cv33
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no auth (PR:N) but requires the user to visit it (UI:R); the sandbox escape crosses a trust boundary (S:C) with total memory-corruption impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome's Dawn WebGPU implementation prior to 150.0.7871.46 lets a remote attacker use a crafted HTML page to trigger an out-of-bounds read and write, potentially breaking out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 (scope-changed), it requires the victim to visit a malicious page but no authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to visit or be redirected to an attacker-controlled HTML page (UI:R user interaction), and the browser must process the crafted WebGPU content in the Dawn component - WebGPU must be enabled (it is on by default in modern Chrome). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals partially conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page containing crafted WebGPU/JavaScript that drives Dawn into an out-of-bounds read and write in the GPU process; when a victim is lured to visit it, the memory corruption is triggered. Chained with the OOB write primitive, the attacker could corrupt process memory to escape the renderer sandbox and gain broader code execution on the host. … |
| Remediation | Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); relaunch the browser to complete the update since Chrome does not apply the fix until restart. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit deployed Chrome versions across the organization and identify systems running versions earlier than 150.0.7871.46. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today