EUVD-2026-17795
GHSA-xf76-839h-pfpm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
7DescriptionCVE.org
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 2
AnalysisAI
Remote code execution in Google Chrome prior to version 146.0.7680.178 via a use-after-free vulnerability in the Dawn graphics component allows attackers who have already compromised the renderer process to execute arbitrary code through a crafted HTML page. The vulnerability requires prior renderer compromise but results in full code execution with high severity per Chromium's security classification.
Technical ContextAI
The vulnerability exists in Dawn, Google's graphics abstraction layer used by Chrome for GPU rendering operations. Use-after-free vulnerabilities (CWE-416) occur when memory is accessed after it has been freed, typically causing memory corruption that can be leveraged for code execution. This specific instance affects the renderer process memory management within Dawn's graphics pipeline. The CPE designation cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all versions of Google Chrome prior to the patched release are affected.
RemediationAI
Vendor-released patch: Google Chrome 146.0.7680.178 or later. Users should immediately update to the latest available Chrome version through the browser's built-in update mechanism (Settings > About Google Chrome, or on macOS/Linux via the application menu). Automatic updates are enabled by default in most Chrome installations; however, administrators should verify deployment across managed environments. Detailed patch notes and the complete security advisory are available at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html and https://issues.chromium.org/issues/491518608. No workaround is available for users unable to update immediately; the only effective mitigation is immediate patching.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye (security), bullseye | vulnerable | 120.0.6099.224-1~deb11u1 | - |
| bookworm | vulnerable | 143.0.7499.169-1~deb12u1 | - |
| bookworm (security) | vulnerable | 146.0.7680.164-1~deb12u1 | - |
| trixie | vulnerable | 145.0.7632.159-1~deb13u1 | - |
| trixie (security) | vulnerable | 146.0.7680.164-1~deb13u1 | - |
| forky | vulnerable | 146.0.7680.153-1 | - |
| sid | fixed | 146.0.7680.177-1 | - |
| bullseye | fixed | (unfixed) | end-of-life |
| (unstable) | fixed | 146.0.7680.177-1 | - |
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today