Description

Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:06.433Z",
  "pubdate": "2026-08-25T21:18:06.433Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within the Dawn component of Google Chrome, specifically identified in versions prior to 152.0.7977.65.\nThe vulnerability is classified with a High security severity, as it allows a remote, unauthenticated attacker to achieve arbitrary code execution outside the browser's security sandbox.\nBy leveraging a specially crafted HTML page, an attacker can trigger the memory corruption or logic error inherent in the Dawn component's input handling.\nThe primary risk implication is a total compromise of the end-user's host system, as escaping the sandbox environment grants the attacker elevated privileges relative to the browser process.\nSuccessful exploitation requires the victim to visit a malicious or compromised webpage, which then interacts with the vulnerable Dawn API to execute arbitrary payloads.\nGiven the nature of web-based delivery, the attack vector is remote and requires no prior authentication or local user privilege, making it a critical concern for all users operating on affected versions of Google Chrome.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation of inputs processed by the Dawn component, which serves as the WebGPU implementation for the Chromium browser engine. When the browser parses or executes content from an HTML page, specifically interactions involving WebGPU resources, the Dawn component fails to adequately sanitize or verify the integrity of the provided input before processing it.\nExploitation is initiated through a malicious HTML page containing crafted data structures or WebGPU API calls designed to exploit the validation flaw. When the browser renders the page, the Dawn component attempts to process these malicious inputs, leading to a breakdown in memory safety or a logic error within the internal state machine.\nBy manipulating the inputs provided to the Dawn engine, an attacker can influence memory allocation or flow control, effectively bypassing the constraints enforced by the Chromium sandbox. The sandbox is designed to isolate the rendering process from the underlying host operating system; however, because this flaw occurs within the Dawn component, it provides a primitive for an out-of-bounds access or memory corruption that facilitates a sandbox escape.\nThe attack flow proceeds as follows: First, the attacker hosts a malicious document on a remote server. Second, the victim navigates to this document via Google Chrome. Third, the browser's rendering engine invokes the Dawn component to handle the GPU-accelerated tasks defined in the HTML/JavaScript. Fourth, the malicious input triggers the vulnerability, leading to unauthorized code execution. Finally, the payload executes with the privileges of the parent process, allowing the attacker to break out of the containerized sandbox environment and run arbitrary commands directly on the user's operating system.\nBecause the Dawn library operates at a low level of the graphics stack, exploitation often results in a heap-based buffer overflow or a use-after-free condition. Such memory errors, when precisely timed, allow for the redirection of execution flow to an attacker-controlled memory address where the shellcode or malicious instructions reside.\nThis vulnerability does not require any specific authentication from the user; it is triggered automatically upon the processing of the malicious content by the browser engine. The exploit is entirely network-exposed, provided the victim can be induced to view the malicious content."
}