CVE-2026-9874: Use after free in Dawn in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in Dawn, the WebGPU graphics backend for Google Chrome, affects all Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network without any authentication, though a victim must visit a crafted HTML page, and it carries a CVSS 9.6 Critical score. Successful exploitation gives an attacker full read, write, and denial-of-service capability beyond the Chrome sandbox, effectively escaping the browser's process isolation. A patched-image rebuild at Chrome 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential of any kind is required; any anonymous visitor to the attacker-controlled page is a valid target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental prerequisites.

Blast Radius

• The attacker escapes the Chrome sandbox, gaining code execution in a more privileged browser process outside the sandboxed renderer.
• With sandbox escape achieved, the attacker reads arbitrary files, stored credentials, and session tokens accessible to the browser process.
• The attacker can write or modify data on the host, including persisted browser state, downloaded files, or data reachable by the process.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user session.