EUVD-2026-113433
GHSA-3hqr-j7w6-wvw3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryServe malicious WebGPU/Dawn content
-
ExploitTrigger memory corruption in Dawn
-
ExecutionExecute arbitrary code in renderer
-
ImpactAttacker code runs inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 156.0.8078.79 and to visit or load an attacker-crafted HTML page that exercises the Dawn (WebGPU) code path - this user-interaction requirement (UI:R) is the primary limiting factor; there is no authentication requirement (PR:N). A further structural limit is that successful exploitation yields code execution inside the sandbox (S:U), so this bug alone does not achieve host compromise without an additional sandbox-escape vulnerability. No special victim-side configuration is stated as required; WebGPU/Dawn is reachable in default Chrome builds. The precise conditions needed to trigger the memory corruption are not described in the available sources. |
| Impact | Signals are largely consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution that requires user interaction (visiting a page) with no scope change. SSVC aligns: Technical Impact is 'total' but Exploitation is 'none' and the flaw is not Automatable (it needs a user to browse to attacker content), which is why the vuln.today Decision label is 'this_week' rather than act_now/emergency. EPSS is low (0.20%, 10th percentile), and there is no CISA KEV listing and no confirmed public exploit, so there is no evidence of active or widespread exploitation today. The one tempering factor the description states explicitly is that code execution occurs 'inside the sandbox' - full host compromise would additionally require a separate sandbox-escape chain, so the real-world impact of this single bug is lower than the 8.8 'total technical impact' figure suggests on its own. Net: a real priority to patch promptly given ubiquitous deployment and High technical impact, but not an in-the-wild emergency on current signals. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that drives Chrome's Dawn (WebGPU) implementation to trigger the memory-corruption condition, then lures a victim to open it (e.g., via a link or malvertising). Successful exploitation yields arbitrary code execution within the renderer/sandbox context; full device compromise would require chaining an additional sandbox escape. No public exploit is identified at time of analysis, and the specific trigger mechanism is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Memory corruption in the Dawn (WebGPU) component of Google Chrome affects builds prior to 156.0.8078.79 and lets a remote, unauthenticated attacker potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The user-interaction requirement and the sandbox scope limit real-world impact: exploitation grants code execution within the renderer sandbox, not host compromise, and would require a separate sandbox-escape bug to break out. No public exploit has been identified at time of analysis, EPSS is low at 0.20% (10th percentile), and SSVC records exploitation as none; a vendor patch is available, and the issue is prioritized for remediation this week.
RemediationAI
Vendor-released patch: Chrome 156.0.8078.79 - upgrade through the standard Chrome stable channel update (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html) and confirm the version string after restart, since Chrome applies updates on relaunch. The supplied references do not describe any workaround or configuration-based mitigation, so patching is the complete fix; the practical exposure window is bounded by the required user interaction (loading a crafted HTML page) and by the fact that exploitation stays inside the sandbox, meaning a chained sandbox-escape flaw would be needed for host-level compromise. Maintain inventory checks for embedded Chromium components and confirm downstream browser vendors have rebased to 156.0.8078.79, and track the Chromium issue (https://issues.chromium.org/issues/575150692) and VulDB entry (https://vuldb.com/vuln/428803) for further detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is Chromium's implementation of WebGPU, the graphics and compute API exposed to web content; the flaw is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer), consistent with the buffer-overflow and RCE tags attached to the record. Per the vendor's own severity rating (High) and the CVSS vector, the attack path is network-delivered HTML rendered by Chrome's default configuration, with PR:N indicating no authentication is needed and UI:R indicating the victim must load the malicious page; the exact trigger conditions for the memory corruption are not described in the available sources. The scope metric is Unchanged, which reflects the vendor's statement that a successful exploit yields code execution inside the sandbox rather than at the operating-system privilege level - a full compromise would require chaining with a separate sandbox escape. Exact affected builds are captured by the CPE google:chrome with versions below 156.0.8078.79, and the Chromium issue tracker entry (issues.chromium.org/issues/575150692) is referenced for technical detail.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the user to browse to it (UI:R); code runs within the renderer sandbox so scope is unchanged (S:U) with high C/I/A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 156.0.8078.79 contain a high-severity memory corruption flaw in the WebGPU (Dawn) component. An attacker could exploit this to run malicious code inside the browser sandbox if a user visits a specially crafted webpage. While the sandbox confines the impact, a successful attack could still compromise sensitive data or allow further compromise, so leadership should prioritize patching to maintain endpoint security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB