Google Chrome EUVD-2026-35276

Two stacked prerequisites: (1) the attacker must have already achieved code execution inside a Chrome renderer process - typically via a separate, chained renderer RCE - because Dawn IPC is only reachable from a compromised renderer, not directly from JavaScript on a normal page; (2) the victim must visit attacker-controlled HTML in Chrome or ChromeOS on Linux at a version below 149.0.7827.103, satisfying the UI:R user-interaction requirement. Exploitation is LIMITED to the Linux and ChromeOS platforms (Windows/macOS builds are out of scope per the description), requires WebGPU/Dawn to be reachable (default-enabled in modern Chrome), and is rated High complexity (AC:H), meaning the attacker must win race conditions or satisfy non-trivial state preconditions in Dawn. No authentication to any service is needed beyond the user simply browsing.

The CVSS vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H paints a nuanced picture: network-reachable and unauthenticated, but with High attack complexity and required user interaction (visiting a malicious page), tempered by a Scope-changed full-impact outcome. Critically, the description states the attacker must have ALREADY compromised the renderer process - this is a second-stage bug, not a one-shot RCE, which is why PR:N applies at the web-origin level but practical exploitation requires chaining with a separate renderer exploit. No EPSS score, KEV listing, or SSVC decision is provided in the input; no public exploit identified at time of analysis. Real-world risk is moderate-to-high for targeted attackers (nation-state, commercial exploit vendors) who routinely build such chains, but low for opportunistic mass exploitation. Note also the 'Information Disclosure' tag in the input appears inconsistent with the described sandbox-escape impact - verify scope with the Chrome advisory.

A targeted user is lured to a crafted webpage that first triggers a separate renderer-process vulnerability to gain code execution inside the sandboxed renderer, then issues malformed WebGPU/Dawn commands across the IPC boundary to corrupt state in the GPU process and escape the sandbox. The attacker thereby gains code execution in a higher-privilege Chrome process on Linux or ChromeOS, enabling persistent access, credential theft, or further OS-level escalation. No public exploit identified at time of analysis, but this class of Dawn sandbox-escape bug is a known building block for full Chrome exploit chains used by commercial spyware vendors.