Executive brief
A critical security vulnerability has been identified in Google Chrome's Dawn component, which handles high-performance graphics. An attacker could exploit this flaw by tricking a user into visiting a specially crafted website, potentially allowing them to bypass the browser's security sandbox. If successful, this could lead to unauthorized access to the underlying operating system and sensitive user data.
Technical details
A use-after-free (UAF) vulnerability exists in Dawn, the WebGPU implementation in Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the processing of graphics-related tasks. A remote, unauthenticated attacker can exploit this by inducing a user to load a malicious HTML page, leading to arbitrary code execution outside of the browser's sandbox environment. This vulnerability is tracked as CVE-2026-14417 and was addressed in Chrome version 150.0.7871.46.
Affected products
- Google Chrome Prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Fixed in Chrome 150.0.7871.46/.47 stable channel update.
- 2026-07-01: advisory: NVD published the CVE record.