Executive brief
A vulnerability in Google Chrome's Dawn component could allow an attacker to execute unauthorized code on a user's computer. This issue occurs if a user visits a specially crafted malicious website. While the attack requires the attacker to have already partially compromised a part of the browser, a successful exploit could allow them to bypass security boundaries and gain further control over the system.
Technical details
An inappropriate implementation vulnerability exists in Dawn, the WebGPU implementation in Google Chrome. The flaw is categorized as improper input validation (CWE-20). A remote attacker who has already achieved code execution within the sandboxed renderer process can leverage this vulnerability by enticing a user to visit a crafted HTML page. This allows the attacker to escalate their capabilities and execute arbitrary code within the sandbox environment. The vulnerability was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published.