CVE-2026-10983: Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149

Synopsis

Insufficient input validation in Dawn, the WebGPU graphics backend in Google Chrome, allows a remote attacker to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network without any account or credentials, but requires the victim to visit a malicious or attacker-controlled page. Successful exploitation gives the attacker code execution outside the Chrome sandbox, bypassing the primary isolation boundary between web content and the host system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in a browsing context.

• AuthenticationNot required

  No account or credentials of any kind are required; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race conditions or special environmental preconditions on the attacker.

Blast Radius

• The attacker escapes the Chrome sandbox and executes arbitrary code in the context of the host process, breaking the primary isolation boundary.
• With sandbox escape, the attacker reads files, credentials, and session data accessible to the user running Chrome on the host.
• The attacker writes or modifies files on the host filesystem and can persist malicious code across reboots.
• The attacker disrupts or terminates host-level processes, causing denial of service on the affected system.