CVE-2026-11676: Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149

Synopsis

Insufficient input validation in Dawn (the WebGPU implementation inside Chrome) affects Google Chrome on Linux and ChromeOS prior to version 149.0.7827.103. The vulnerability is reachable over the network and requires no prior authentication, but the attacker must already have compromised the renderer process and also needs the victim to interact with a crafted HTML page. Successful exploitation allows a full sandbox escape, giving the attacker code execution outside the browser sandbox with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target host must be reachable through a browser session exposed to remote content.

• AuthenticationNot required

  No account or credential is needed to serve the malicious page to the victim; the attack is mounted by any remote party.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must already have compromised the renderer process before this bug can be used for sandbox escape, introducing a meaningful prerequisite beyond simply serving a page.

Blast Radius

• A successful attacker escapes the Chrome sandbox entirely, gaining code execution in the context of the host OS user running Chrome.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to that OS user.
• The attacker can write or modify files on the host, including configuration files and persistent storage used by other applications.
• The attacker can crash or disrupt the Chrome process and any host services accessible under the same user context.