Google Chrome EUVD-2026-116498

Exploitation requires a victim using Chrome prior to 157.0.8103.38 to open an attacker-controlled crafted HTML page that exercises the Dawn (WebGPU) component (CVSS UI:R). WebGPU/Dawn is reachable from default web content in modern Chrome, so no non-default configuration is indicated by the sources, and no authentication is required (PR:N). The primary limiting factor is the required user interaction - the target must navigate to or load the malicious page; there is no indication of drive-by exploitation without that interaction, and the specific internal trigger within Dawn is not detailed in the available sources. The scope change (S:C) reflects that successful exploitation can execute code outside the renderer sandbox, impacting the host beyond the browser process.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes remote, low-complexity, unauthenticated exploitation needing only that a victim open a page, with a scope change reflecting the escape from Chrome's renderer sandbox and total confidentiality/integrity/availability impact. The vuln.today Decision label is act_now and the vendor rates it Critical, which aligns with that severity. However, the signals are not uniform: CISA SSVC lists Exploitation as none, Automatable as no, and Technical Impact as total - so impact is maximal but there is no evidence of active exploitation or scalable mass-exploitation at analysis time. There is no KEV listing and no EPSS score in the provided data, so near-term exploitation probability cannot be quantified from these inputs. The references point to the Chrome release blog and a (likely access-restricted) Chromium issue tracker entry, which is a bug-tracker reference rather than a working exploit. Net: treat as urgent patch-now per the act_now label driven by severity and sandbox-escape potential, while recognizing that current data shows capability (total impact, network-reachable) rather than confirmed in-the-wild use.

An attacker hosts or compromises a web page containing crafted content that drives Chrome's Dawn (WebGPU) component, and lures a victim running a vulnerable Chrome build (prior to 157.0.8103.38) to visit it. Rendering the page triggers a heap buffer overflow in Dawn that, per the vendor, can lead to code execution outside the browser sandbox. No public exploit is identified at time of analysis; the exact trigger mechanism is not described in the available sources.