EUVD-2026-50943
GHSA-434r-58rq-9884
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryServe crafted WebGPU HTML/JS
-
ExploitTrigger use-after-free in Dawn
-
ExecutionCorrupt renderer heap
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page that exercises the WebGPU/Dawn code path (UI:R - user interaction in the form of visiting the page), with no authentication or special privileges needed (PR:N) against default Chrome installations where WebGPU is enabled. The key limiting factor is that resulting code execution is confined to the renderer sandbox - meaningful host compromise additionally requires a separate sandbox-escape exploit. Disabling WebGPU removes the required attack surface entirely. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a low-complexity, unauthenticated, network-reachable bug needing only user interaction - the classic drive-by browser profile. However, the description explicitly states code execution occurs 'inside a sandbox,' and Chromium assigned a severity of Low, signaling the compromise is contained to the renderer process and would require a separate sandbox-escape chain to reach the host. This is a genuine conflict worth flagging: the raw 8.8 overstates real-world impact for a sandboxed-only primitive. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active or imminent exploitation. Net priority: patch on the normal browser-update cadence - real but not emergency, unless chained with an unpatched sandbox escape. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGPU/JavaScript that manipulates Dawn into freeing and then reusing a GPU object, and lures a victim to visit it via phishing, malvertising, or a compromised site. When the page loads, the use-after-free corrupts renderer heap memory and executes attacker-controlled code within the browser's sandbox. No public exploit is identified at time of analysis; escaping to the host would require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Memory-corruption remote code execution in Google Chrome's Dawn WebGPU graphics component affects all Desktop builds prior to 151.0.7922.72, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code - though confined inside the renderer sandbox, which is why Chromium rated it Low despite the CVSS 8.8. Exploitation requires only that a victim load a malicious page (UI:R), with no authentication. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Desktop channel (chrome://settings/help forces the update check, then relaunch to apply). Enterprise fleets should push the update through their managed-browser channel and confirm relaunch, since Chrome's background updater does not take effect until restart. Reference advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, reduce exposure by disabling WebGPU via enterprise policy or the chrome://flags/#enable-unsafe-webgpu toggle, which removes the Dawn attack surface at the cost of breaking GPU-accelerated web applications; avoiding untrusted sites and maintaining standard sandbox hardening further limit risk. Users of other Chromium-based browsers should apply their vendor's corresponding Dawn update when released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is Chromium's cross-platform implementation of the WebGPU API, the successor to WebGL that gives web pages low-level access to GPU compute and rendering. It parses and validates GPU commands originating from untrusted JavaScript, making it a rich attack surface for memory-safety bugs. The flaw is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent access to that stale pointer allows an attacker to corrupt heap memory and hijack control flow. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop application; because Dawn is also embedded in other Chromium-based browsers (Edge, Brave, Opera, Electron apps), downstream products built on the same engine may share the underlying defect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs only a victim visit (AV:N/AC:L/PR:N/UI:R); renderer RCE yields full C/I/A within the unchanged sandbox scope (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in the WebGPU graphics component affecting all desktop users. An attacker can exploit this through a malicious webpage requiring no user authentication, potentially enabling credential theft and data exfiltration from organizational endpoints despite the attack being confined to the browser sandbox.
Apply vendor patch: Google Chrome 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Implementation and Policy Flaws
View all 50Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB