CVE-2026-11687: Use after free in Dawn in Google Chrome on Mac prior to 149

Synopsis

Use-after-free in Dawn (the WebGPU backend) in Google Chrome on macOS prior to version 149.0.7827.103. The vulnerability is reachable over the network with no authentication required, but does require a victim to visit a crafted HTML page. Successful exploitation corrupts heap memory, giving the attacker the ability to read sensitive data, tamper with memory contents, and crash or take control of the affected process. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a malicious URL, so the Chrome instance must be reachable via normal browser traffic.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can attempt the exploit by serving a crafted HTML page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Reads process memory contents, including session tokens, credentials, or GPU-bound data processed by the Dawn WebGPU backend.
• Modifies heap memory, allowing an attacker to overwrite internal browser state or injected data structures.
• Crashes the Chrome renderer or GPU process, causing an immediate denial of service for the affected user.
• Heap corruption at this severity level carries a realistic risk of full renderer process compromise, enabling arbitrary code execution within the Chrome sandbox on the affected Mac host.