CVE-2026-14420: Out of bounds read and write in Dawn in Google Chrome prior to 150

Synopsis

An out-of-bounds read and write vulnerability exists in Dawn, the WebGPU implementation inside Google Chrome versions prior to 150.0.7871.46. The flaw is reachable over the network with no authentication required, but a victim must visit a crafted HTML page for the attack to trigger. Successful exploitation enables sandbox escape, giving an attacker the ability to read and write memory outside the Chrome sandbox, execute arbitrary code on the underlying host, and fully compromise confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential of any kind is required; the exploit works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must navigate to or be redirected to the crafted HTML page, requiring at minimum a click on a malicious link or a drive-by redirect.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race wins, or memory-layout prerequisites.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code as the OS-level user running Chrome, outside the browser sandbox.
• The attacker reads any data accessible to that OS user, including stored credentials, session tokens, and files on disk.
• The attacker writes or modifies files and persisted data accessible to that OS user, including application data and configuration.
• The attacker can crash or destabilize the host process and dependent services, causing a loss of availability.