Google Chrome CVE-2026-17995

Exploitation requires the victim to actively load attacker-controlled content in a vulnerable Chrome build (before 151.0.7922.72) that exercises the WebGPU/Dawn code path - i.e., WebGPU must be reachable/enabled and the crafted page must trigger the specific Dawn parsing routine. The CVSS vector's UI:R confirms user interaction (visiting/opening the malicious page) is mandatory, which is the key limiting factor; no authentication is needed (PR:N) and no local access is required (AV:N). Disabling WebGPU or blocking navigation to untrusted pages removes the reachable condition.

Signals conflict and should be weighed rather than taken at face value. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) drives an 8.1 'High' score with high confidentiality and availability impact, but Chromium's own triage labeled this 'Low' severity, and CWE-125 (a read, not write) with I:N is consistent with information disclosure/crash rather than code execution. EPSS is low (0.17%, 7th percentile), there is no CISA KEV listing and no public exploit identified, so this is not currently an urgent, mass-exploited issue. The most important caveat: the CVSS C:H/A:H rating appears aggressive for a low-severity OOB read confined to a browser sandbox - an OOB read that leaks limited memory or crashes a tab more plausibly warrants lower confidentiality/availability impact, so treat the 8.1 as an upper bound and prioritize via normal browser-patch cadence rather than emergency response.

An attacker hosts or injects a malicious HTML page containing crafted WebGPU calls and lures a victim into visiting it (AV:N, UI:R). When Chrome's Dawn component processes the crafted input, it reads memory outside the intended buffer, potentially disclosing adjacent process memory to the attacker or crashing the renderer. No public exploit code is identified at time of analysis.