CVE-2026-10921: Integer overflow in Dawn in Google Chrome prior to 149

Synopsis

An integer overflow in Dawn, the WebGPU implementation inside Google Chrome, allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox. The vulnerability is reachable over the network and requires the victim to visit a crafted HTML page, though no authentication is needed. Successful exploitation gives the attacker code execution outside the renderer sandbox, enabling full read, write, and disruption of data on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach a remote attacker-controlled page.

• AuthenticationNot required

  No account or credentials are needed; any anonymous visitor can be targeted.

• Victim interactionRequired

  The victim must navigate to or be social-engineered into loading a crafted HTML page in the affected browser.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must first have compromised the renderer process before the integer overflow can be used for sandbox escape, introducing a meaningful pre-condition.

Blast Radius

• An attacker who succeeds reads arbitrary files and data accessible to the browser process on the host, bypassing the sandbox boundary.
• The attacker can write or modify data on the host filesystem outside the sandbox, including user profile data and credentials stored on disk.
• The attacker gains code execution in the context of the host process, enabling installation of persistent malware or further lateral movement.
• The host process and dependent services can be crashed or rendered unavailable, disrupting the user's session and any locally running services.