CVE-2026-11154: Use after free in Dawn in Google Chrome prior to 149

Synopsis

Use-after-free in Dawn (the WebGPU backend) in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape the Chrome sandbox via a crafted HTML page. The attack requires the victim to visit a malicious page and involves high attack complexity, but no authentication is needed. Successful exploitation gives the attacker full control over the host process outside the sandbox, enabling arbitrary code execution, data theft, and system tampering. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted HTML page to the victim over the network, requiring the target to reach an attacker-controlled web resource.

• AuthenticationNot required

  No account or credentials are needed; the exploit is reachable by any unauthenticated visitor to the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker must socially engineer the target into visiting a malicious URL.

• Attack complexityDetail

  Attack complexity is High, meaning the attacker must first achieve renderer process compromise before the use-after-free can be used for sandbox escape, making reliable exploitation dependent on chaining with a prior vulnerability.

Blast Radius

• An attacker who succeeds in the sandbox escape can execute arbitrary code outside the Chrome sandbox with the privileges of the browser process.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local files, becomes readable.
• The attacker can write or modify files and system state on the host, enabling persistence or lateral movement.
• The host process can be crashed or destabilized, causing service disruption for the affected user session.