CVE-2026-17758: Google Chrome Dawn Buffer Overflow Flaw

CVE-2026-17758 Overview

CVE-2026-17758 is a heap buffer overflow vulnerability in Dawn, the WebGPU implementation used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the issue by serving a crafted HTML page to a victim's browser. Successful exploitation may allow the attacker to escape the Chrome sandbox. Chromium classifies the security severity as Medium. The vulnerability is tracked under [CWE-122] (Heap-based Buffer Overflow).

Critical Impact
A crafted HTML page can trigger a heap buffer overflow in Dawn and potentially achieve a Chrome sandbox escape from a remote origin.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable Dawn (WebGPU) component
Desktop Chrome Stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17758 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17758

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform WebGPU implementation shipped with Chrome. Dawn translates WebGPU API calls from web content into native graphics API calls on the host. A heap buffer overflow in this component allows out-of-bounds writes on heap-allocated memory. Because Dawn processes attacker-controlled data from the renderer, corrupted heap state can be leveraged to influence execution beyond the intended memory region. Chromium's advisory indicates the flaw may be chained to escape the browser sandbox, elevating impact beyond the renderer process.

Root Cause

The issue is a heap-based buffer overflow [CWE-122] in Dawn's handling of WebGPU-related data structures. Insufficient bounds checking during memory operations permits writes past the allocated buffer boundary. Public disclosure does not identify the specific function or code path. Refer to the Chromium Issue Tracker Entry once access restrictions are lifted for full technical details.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build. The page delivers WebGPU content that triggers the overflow in Dawn. No authentication is required, and the attack is network-reachable through any origin serving the malicious page. Combined with a suitable primitive, the overflow can support a sandbox escape rather than remaining confined to renderer memory corruption.

No public proof-of-concept, exploit code, or Exploit-DB entry is available at the time of publication. See the Google Chrome Update Announcement for the vendor's coordinated disclosure.

Detection Methods for CVE-2026-17758

Indicators of Compromise

Chrome renderer or GPU process crashes referencing Dawn or WebGPU modules in crash telemetry
Unexpected child process creation from chrome.exe following visits to untrusted sites hosting WebGPU content
Outbound connections to newly registered or low-reputation domains hosting HTML pages that invoke WebGPU APIs

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds earlier than 151.0.7922.72
Monitor browser process trees for anomalous spawning of shells, scripting hosts, or LOLBins from Chrome GPU or renderer processes
Correlate crash dumps in the GPU process with subsequent suspicious process or file activity on the same host

Monitoring Recommendations

Ingest Chrome crash and update telemetry into the SIEM for version compliance reporting
Track proxy and DNS logs for browsing sessions immediately preceding renderer or GPU process crashes
Alert on post-exploitation behaviors such as credential access, persistence, or lateral movement originating from browser child processes

How to Mitigate CVE-2026-17758

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart the browser after the update to ensure the patched Dawn component is loaded
Prioritize patch deployment for users who browse untrusted content or handle sensitive data

Patch Information

Google addressed CVE-2026-17758 in the Chrome Stable channel release 151.0.7922.72. Deploy the update through enterprise management channels such as Chrome Browser Cloud Management, Group Policy, or your endpoint management platform. Chromium-based browsers that embed Dawn should incorporate the corresponding upstream fix. Refer to the Google Chrome Update Announcement for release details.

Workarounds

Disable WebGPU via enterprise policy where business use cases do not require it, reducing exposure to Dawn code paths
Restrict access to untrusted websites through web filtering or browser isolation until patches are fully deployed
Enforce Chrome auto-update policies to prevent users from remaining on vulnerable builds

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version