CVE-2026-14417: Use after free in Dawn in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in Dawn, the WebGPU implementation in Google Chrome, allows a remote attacker to exploit the browser through a specially crafted HTML page. The attack is reachable over the network, requires no authentication, but does need the victim to visit a malicious page; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects a scope change, meaning the exploit can break out of the Chrome sandbox and affect resources beyond the browser process itself. Successful exploitation gives the attacker full read, write, and availability impact on the host, including confidential data, persistent modification, and potential code execution outside the sandbox. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential of any kind is needed; any user browsing to the malicious page is a valid target.

• Victim interactionRequired

  The victim must visit the attacker-controlled page, making social engineering (phishing link, malicious ad, compromised site) a necessary step.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• The attacker reads confidential data accessible to the Chrome process, including stored credentials, cookies, and session tokens.
• The attacker writes or modifies data within the browser context and, via sandbox escape, on the underlying host filesystem or process space.
• The scope change (S:C) means impact extends beyond the browser sandbox, so host-level processes and resources are reachable after exploitation.
• The attacker can crash or destabilize the affected Chrome process or, post-escape, other services on the host, disrupting availability.