Executive brief
A critical security flaw has been identified in Google Chrome's Dawn component, which handles graphics processing. An attacker can exploit this vulnerability by tricking a user into visiting a malicious website, potentially allowing the attacker to take full control of the user's computer. This issue is particularly serious as it is known to be actively exploited by attackers in the wild.
Technical details
A use-after-free (UAF) vulnerability exists in Dawn, the WebGPU implementation in Chromium. The flaw (CWE-416) can be triggered by a remote attacker via a crafted HTML page. Exploitation requires the attacker to have already compromised the renderer process (a 'sandbox escape' or 'chain' scenario). Successful exploitation allows for arbitrary code execution in the context of the browser. Google has confirmed that this vulnerability is being exploited in the wild. The issue is resolved in Chrome version 146.0.7680.178 and later.
Affected products
- Google Chrome prior to 146.0.7680.178
- Microsoft Edge
- Opera Opera
Timeline
- 2026-03-10: disclosed: Vulnerability reported to Chrome by researcher.
- 2026-03-31: patched: Google released Chrome version 146.0.7680.178 to address the issue.
- 2026-04-01: advisory: NVD and CISA published advisories.
- 2026-04-01: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.
- 2026-04-01: exploited: Google confirmed active exploitation in the wild.