CVE-2026-10909: Use after free in Dawn in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in Dawn, the WebGPU implementation inside Google Chrome, affects all Chrome versions prior to 149.0.7827.53. The bug is reachable over the network, requires no authentication, but does require the attacker to have already compromised the renderer process and to lure a victim into visiting a crafted HTML page. Successful exploitation allows a full sandbox escape, giving the attacker high-impact read, write, and availability control beyond the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or the victim must browse to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account are needed; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The victim must open a crafted HTML page, making social engineering or drive-by delivery a prerequisite for exploitation.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the renderer process before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• Reads sensitive data from memory outside the browser sandbox, including credentials, session tokens, and other process memory.
• Writes arbitrary data to memory outside the sandbox, enabling code injection or persistent modification of browser state.
• Crashes or destabilizes the affected Chrome process, causing service disruption for the user.
• Achieves a full sandbox escape, allowing the attacker to execute code at the privilege level of the host Chrome process, bypassing Chrome's primary isolation boundary.