EUVD-2026-50678
GHSA-ffm3-9wph-xpfx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JavaScript issues WebGPU calls
-
ExploitTrigger heap buffer overflow in Dawn
-
ExecutionCorrupt GPU-process memory
-
PersistEscape renderer sandbox
-
ImpactExecute code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-controlled HTML page in a vulnerable Chrome (prior to 151.0.7922.72) with WebGPU/Dawn enabled - WebGPU is enabled by default on supported platforms and GPUs, so most default desktop installs are exposed. Limiting factors: user interaction is required (UI:R - the victim must actively visit the malicious page), the target must be running a pre-151.0.7922.72 build, and the sandbox escape is described as only 'potential', implying a full host compromise may need additional chaining or specific conditions rather than being guaranteed from the single bug. No authentication is required (PR:N). |
| Impact | Signals conflict and should be weighed together. CVSS is 9.6 (Critical) driven by network vector, low complexity, no privileges, and a scope change (S:C) modeling the sandbox escape - but it requires user interaction (UI:R), so it is not wormable or fully unauthenticated-drive-by without a victim visiting a page. Google's own Chromium severity rating is only 'Medium', and the description hedges with 'potentially perform a sandbox escape', indicating the escape is theorized/partial rather than a demonstrated full break. EPSS is low (0.22%, 13th percentile), there is no KEV listing and no public POC, so real-world exploitation risk is currently low-to-moderate despite the high CVSS. Net: patch on Chrome's normal cadence - this is a genuine memory-safety bug worth fixing, but the 9.6 overstates present real-world urgency given Google's Medium rating, low EPSS, no known exploitation, and the mitigating user-interaction requirement. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGPU/JavaScript that drives Dawn into an out-of-bounds heap write, then lures a victim into visiting it (link, ad, or compromised site). Given UI:R and low attack complexity, a single page load in a vulnerable Chrome could corrupt GPU-process memory and, if chained successfully, escape the sandbox to run code on the host. No public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, which contains the Dawn fix; verify via chrome://settings/help and relaunch to complete the update, as Chrome staged rollouts can delay automatic delivery. See the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html . If patching cannot be completed immediately, a specific compensating control is to disable WebGPU/Dawn by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled or deploying the WebGPU enterprise policy to off, which removes the vulnerable attack surface at the cost of breaking WebGPU-dependent sites and GPU-accelerated web apps; reducing exposure to untrusted sites and enforcing prompt auto-update via enterprise policy are additional interim measures. Users of Chromium-based browsers should apply their vendor's build incorporating the same Dawn fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is Chromium's open-source implementation of the WebGPU standard, providing web pages GPU compute and rendering access that runs in Chrome's GPU process. The root cause is CWE-122, a heap-based buffer overflow: attacker-controlled WebGPU calls from JavaScript reach native Dawn code where insufficient bounds checking on a heap allocation permits an out-of-bounds write. Because WebGPU is exposed to untrusted web content and Dawn code executes with GPU-process privileges (a less-restricted context than the renderer), a memory-corruption bug here is a plausible sandbox-escape primitive rather than a mere renderer crash. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only user visit (PR:N/UI:R), but reliable heap-overflow sandbox escape requires exploit sophistication so AC:H; scope changes (S:C) on escape with full host impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability in the WebGPU implementation; no public exploit identified at time of analysis, though successful exploitation could allow attackers to compromise host systems. While exploitation requires users to visit malicious websites and the current threat level is low (EPSS 0.22%), the potentially severe impact of sandbox bypass justifies urgent patching across all Chrome deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB