CVE-2026-11687: Google Chrome Use After Free Vulnerability

CVE-2026-11687 Overview

CVE-2026-11687 is a use-after-free vulnerability [CWE-416] in the Dawn component of Google Chrome on macOS. Dawn is the WebGPU implementation that bridges browser graphics calls to native GPU APIs. The flaw affects Chrome versions prior to 149.0.7827.103 and allows a remote attacker to trigger heap corruption through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website. Google classifies the Chromium security severity as High.

Critical Impact
A remote attacker can trigger heap corruption in the Dawn WebGPU component by luring a macOS user to a malicious page, enabling potential arbitrary code execution within the renderer process.

Affected Products

Google Chrome on macOS prior to 149.0.7827.103
Apple macOS systems running vulnerable Chrome builds
Chromium-based applications embedding affected Dawn/WebGPU code

Discovery Timeline

2026-06-09 - CVE-2026-11687 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11687

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform implementation of WebGPU used by Chromium. WebGPU exposes GPU resources to JavaScript running in the browser. A use-after-free occurs when code references memory that has already been deallocated, allowing the attacker to influence the contents of the freed region before reuse.

In the context of Dawn, GPU resource lifetime management is complex because objects are referenced across the renderer process and the GPU process. Improper reference counting or premature release of an internal object can leave a dangling pointer. When the dangling pointer is dereferenced, the heap allocator may have already returned the slot to a different allocation controlled by attacker JavaScript.

Exploitation through a crafted HTML page can lead to heap corruption, type confusion, and ultimately code execution inside the sandboxed renderer. Combined with a sandbox escape, the issue can compromise the host system. The vulnerability requires user interaction, since the victim must load attacker-controlled content.

Root Cause

The root cause is improper object lifetime handling in the Dawn WebGPU implementation on macOS. A GPU resource is freed while a separate code path retains a pointer to it, producing a classic use-after-free condition [CWE-416].

Attack Vector

An attacker hosts a malicious HTML page that issues specific WebGPU API calls from JavaScript. The page triggers the unsafe object lifetime sequence inside Dawn. After the freed memory is reclaimed with attacker-controlled data, subsequent operations corrupt the heap.

No verified public exploit code is available. See the Chromium Issue Tracker Entry and the Google Chrome Update Notice for additional technical context.

Detection Methods for CVE-2026-11687

Indicators of Compromise

Chrome renderer or GPU process crashes referencing dawn::, webgpu, or Metal backend symbols on macOS endpoints
Outbound connections from Chrome to unknown domains immediately preceding renderer crashes
Browser telemetry showing Chrome versions on macOS below 149.0.7827.103 in the fleet

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build earlier than 149.0.7827.103
Monitor for repeated Chrome Helper (GPU) and Helper (Renderer) process crashes, which can indicate exploitation attempts against WebGPU
Correlate web proxy logs with crash events to identify URLs serving WebGPU content that triggers instability

Monitoring Recommendations

Forward Chrome crash reports and macOS ReportCrash artifacts to a centralized log platform for analysis
Alert on creation of child processes by Chrome helper processes that deviate from baseline behavior
Track WebGPU adoption in the environment and review whether the feature is required for business use

How to Mitigate CVE-2026-11687

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 149.0.7827.103 or later
Verify automatic update channels are enabled and reporting back to management tooling
Restart Chrome after patch installation to ensure the vulnerable Dawn code is unloaded from memory

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Update Notice. Install Chrome 149.0.7827.103 or later on macOS. Chromium-based browsers and embedded frameworks that ship Dawn should pull the corresponding upstream fix.

Workarounds

Disable WebGPU temporarily by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled until patching is complete
Deploy enterprise policy to block access to untrusted sites that require WebGPU
Restrict Chrome usage on macOS to managed profiles where extensions and unknown sites are limited

bash

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Enforce minimum version via Jamf or MDM configuration profile
# Example policy key for Google Chrome managed preferences
defaults write com.google.Chrome TargetVersionPrefix -string "149.0.7827.103"