CVE-2026-14424: Use after free in Dawn in Google Chrome on Mac prior to 150

Synopsis

A use-after-free vulnerability exists in Dawn, the WebGPU backend used by Google Chrome on macOS, affecting versions prior to 150.0.7871.46. The flaw is reachable over the network without authentication, but requires a victim to visit a crafted HTML page. Successful exploitation gives a remote attacker full read, write, and availability impact across a scope beyond the browser process itself, enabling a sandbox escape. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome process must be reachable to load remote content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making social engineering or a malicious link the delivery mechanism.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory-layout assumptions, or other environmental prerequisites.

Blast Radius

• The attacker escapes the Chrome renderer sandbox, gaining code execution outside the browser's confined process.
• With sandbox escape achieved, the attacker can read arbitrary files and stored credentials accessible to the macOS user running Chrome.
• The attacker can write or modify data on the filesystem or inject into other processes running under the same user account.
• The attacker can crash or destabilize the browser and any dependent services, causing loss of availability for the affected session.