EUVD-2026-35213
GHSA-qv8p-84pr-826v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious HTML page
-
DeliveryLure macOS Chrome user to page
-
ExploitJavaScript issues crafted WebGPU calls to Dawn
-
ExecutionTrigger use-after-free and reclaim freed object
-
PersistCorrupt heap and hijack control flow
-
ImpactExecute attacker code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the victim running Google Chrome on macOS at a version below 149.0.7827.103, (2) the victim visiting an attacker-controlled or compromised HTML page (UI:R - user interaction required), and (3) WebGPU/Dawn being reachable from the rendering context, which it is by default in modern Chrome. No authentication to any service is needed (PR:N) and no special browser configuration beyond defaults is required. Limiting factors: the bug is scoped to macOS only per the vendor advisory so Windows/Linux/ChromeOS users are not affected by this CVE, the user must actively load the malicious page, and the resulting code execution is inside the Chrome renderer sandbox - escaping to the host requires chaining an additional sandbox-escape vulnerability. |
| Impact | The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a classic browser drive-by: network-reachable, low complexity, no privileges, but requires user interaction (visiting a page). The Scope:Unchanged and full CIA impact indicate code execution inside the renderer sandbox, which on its own does not break out of the sandbox but is the first stage of most Chrome exploit chains. No EPSS score, KEV listing, or POC was provided in the source data, so real-world exploitation status is unknown - however, Dawn/WebGPU use-after-free bugs have been exploited in the wild in prior Chrome cycles, so this should not be deprioritized solely on absent telemetry. The macOS-only scoping narrows the affected population but does not reduce per-host severity for impacted users. |
| Exploit ScenarioDerived | An attacker hosts or compromises a website containing a crafted HTML page with JavaScript that issues a specific sequence of WebGPU calls to Dawn, freeing a GPU-related object and then reallocating attacker-controlled data into the freed slot before reuse. When a macOS Chrome user on a vulnerable build visits the page (via phishing link, malvertising, or watering hole), the use-after-free triggers heap corruption inside the renderer process, giving the attacker an initial code execution primitive that would typically be chained with a sandbox escape for full system compromise. No public exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Heap corruption in Google Chrome on macOS prior to 149.0.7827.103 enables remote attackers to potentially execute arbitrary code by luring a user to a crafted HTML page that exploits a use-after-free in the Dawn WebGPU implementation. The flaw carries a CVSS 8.8 (High) rating and Chromium rates it High severity; no public exploit has been identified at time of analysis, but Chrome browser bugs of this class are historically attractive targets for in-the-wild exploitation. Patch is available from Google.
RemediationAI
Vendor-released patch: update Google Chrome on macOS to 149.0.7827.103 or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html; Chrome will auto-update on restart, so administrators should force-relaunch browsers across the fleet to ensure the fix is loaded. As a temporary compensating control until patching completes, WebGPU can be disabled by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled and, for managed fleets, deploying the Chrome enterprise policy to disable WebGPU - note that this will break legitimate sites and web apps that depend on GPU acceleration via WebGPU (3D visualization, ML demos, some games). Endpoint protection and macOS Gatekeeper do not mitigate this in-browser memory corruption, so patching is the only durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing a low-level GPU API to web content via the browser's renderer process. The root cause is CWE-416 (Use After Free): memory referenced by a pointer is freed but the pointer is subsequently dereferenced, allowing an attacker who can influence the reallocation of that memory region to corrupt the heap and steer execution. Because Dawn handles attacker-controlled WebGPU command streams from JavaScript, a malicious HTML page can drive the allocation/free sequence needed to trigger the bug. The platform scope is specifically macOS per the Chrome advisory, which typically reflects Dawn's Metal backend implementation rather than the cross-platform abstraction layer.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS versions prior to 149.0.7827.103 contains a vulnerability enabling remote code execution when users visit crafted websites; no public exploit has been identified at time of analysis. This affects all macOS-based employees using Chrome and creates risk of data exfiltration, malware installation, and system compromise. Immediate patching is required to prevent exploitation of this high-severity flaw.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB