CVE-2026-13776: Type Confusion in Dawn in Google Chrome prior to 150

Synopsis

A type confusion vulnerability in Dawn, the WebGPU implementation inside Google Chrome, allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The attack is reachable over the network and requires no authentication, though the victim must visit a malicious page. Successful exploitation gives the attacker full read, write, and availability impact outside the browser sandbox, effectively achieving code execution at the host level. A patched-image rebuild at Chrome 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable through normal browser traffic.

• AuthenticationNot required

  No account or credential of any kind is required; any unauthenticated user who visits the malicious page is a valid target.

• Victim interactionRequired

  The victim must open a crafted HTML page in an affected version of Chrome, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the attacker having already compromised the renderer process.

Blast Radius

• Reads any data accessible to the browser process and the underlying OS user account, including stored credentials, cookies, and session tokens.
• Writes or modifies files and OS-level resources outside the browser sandbox, enabling persistence or further lateral movement.
• Crashes or destabilizes the host process or dependent services, disrupting availability beyond the browser tab.
• Because the scope is Changed (S:C in the CVSS vector), impact extends beyond the sandboxed renderer to the host environment, multiplying the effective blast radius.