EUVD-2026-66005
GHSA-5j29-wxhr-87rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML/WebGPU page
-
DeliveryUser visits page in unpatched Chrome
-
ExploitDawn allocates uninitialized GPU resource
-
ExecutionAttacker JavaScript reads uninitialized memory
-
ImpactSandbox memory contents disclosed to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | The victim must visit an attacker-controlled or compromised web page using an unpatched Chrome desktop browser (versions prior to 152.0.7977.65). User interaction is required (UI:R per CVSS). No authentication or special privileges are needed on the attacker's side. Exploitation is limited to memory readable within Chrome's renderer sandbox - the flaw does not on its own break out of the sandbox or access OS-level memory. There is no indication that a non-default Chrome configuration is required; standard Chrome with WebGPU-capable hardware is sufficient for the attack surface to exist. |
| Impact | CVSS 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a realistic appraisal: the attack is network-delivered, requires no privileges, but depends on user interaction (visiting a crafted page) and produces only confidentiality loss within the sandbox. EPSS at 0.19% (9th percentile) aligns with a low likelihood of broad opportunistic exploitation in the near term. There is no CISA KEV listing and no known POC at time of analysis. Real-world priority is moderate: the sandbox containment limits immediate blast radius, and the UI:R requirement reduces weaponization ease compared to fully drive-by exploits. However, Chrome's ubiquitous install base means even targeted exploitation could affect large user populations, and memory disclosure bugs in GPU paths have historically served as stepping stones in sandbox escape chains. Organizations should treat this as routine patch-cycle priority rather than emergency response. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGPU shader or resource allocation code that triggers the uninitialized resource condition in Dawn. When a target user visits the page in an unpatched Chrome browser, the attacker-controlled JavaScript can read memory contents from the uninitialized GPU resource - potentially exposing sensitive data held within the renderer sandbox, such as fragments of decoded web content or cached credentials. No public exploit code is known at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
RemediationAI
Update Google Chrome to version 152.0.7977.65 or later via the built-in update mechanism (Settings → Help → About Google Chrome) or by downloading from the official release channel documented at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. The patch is confirmed available per the vendor release advisory and EUVD. No official workaround is documented; as a compensating control, organizations that cannot patch immediately should consider restricting access to sites that serve WebGPU content by disabling the WebGPU feature flag (chrome://flags/#enable-unsafe-webgpu), though this will break legitimate WebGPU applications and is not suitable as a long-term mitigation. Enterprise environments may also enforce Chrome version policy via group policy or MDM to accelerate deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is Google Chrome's cross-platform implementation of the WebGPU graphics API, responsible for translating high-level GPU commands to native backends (Metal, Vulkan, D3D12). CWE-908 (Use of Uninitialized Resource) describes a root cause where a buffer, structure, or GPU-accessible resource is allocated but not zeroed or populated before being read, inadvertently exposing prior memory contents - in this case, contents readable within Chrome's renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for versions prior to 152.0.7977.65. Because the scope is Unchanged (S:U), the leak is confined to the sandboxed renderer process; kernel or cross-process memory is not directly reachable via this flaw alone.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L), no privileges needed (PR:N), user must visit page (UI:R), disclosure sandbox-contained (S:U, C:H, I:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB