CVE-2026-17810: Google Chrome Dawn Information Disclosure

CVE-2026-17810 Overview

CVE-2026-17810 is an uninitialized memory use vulnerability [CWE-457] in the Dawn component of Google Chrome. Dawn is Chrome's cross-platform implementation of the WebGPU standard. The flaw affects Chrome versions prior to 151.0.7922.72 and allows a remote attacker to leak cross-origin data through a crafted HTML page. Google Chromium classifies the severity as Medium. Successful exploitation breaks the same-origin policy by exposing memory that the browser process did not initialize before use.

Critical Impact
A remote attacker who hosts a crafted HTML page can read cross-origin data from a victim's browser session, undermining web isolation guarantees.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable Dawn/WebGPU implementation
Applications using affected Chromium builds with WebGPU enabled

Discovery Timeline

2026-07-30 - CVE-2026-17810 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17810

Vulnerability Analysis

The vulnerability resides in Dawn, the WebGPU implementation shipped with Chrome. Dawn exposes GPU functionality to web content through JavaScript APIs. The defect involves use of memory or a variable that was never initialized before being read. When the uninitialized region is passed back to the renderer or observable to script, it can contain residual bytes from other browsing contexts or processes.

Because WebGPU handles buffers, textures, and shader resources shared across the GPU process, uninitialized reads can surface data belonging to a different origin. This defeats the browser's cross-origin isolation model and enables silent data exfiltration through a normal web navigation.

Root Cause

The root cause is a failure to initialize memory before it is read, categorized as [CWE-457] Use of Uninitialized Variable. In graphics pipelines, resources such as GPU buffers or command state must be zeroed or explicitly written before being sampled. When this step is skipped in Dawn, downstream operations return stale contents. The Chromium issue tracker entry 516882109 records the internal analysis of the specific code path.

Attack Vector

Exploitation requires the victim to load attacker-controlled HTML. The malicious page issues WebGPU calls that trigger the uninitialized code path in Dawn, then reads back GPU-resident data through script. The attacker uses the leaked bytes to reconstruct cross-origin content such as pixels, buffer contents, or process memory fragments. No authentication or user interaction beyond page navigation is required.

Technical specifics of the crafted call sequence are not disclosed publicly. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update advisory for vendor-side details.

Detection Methods for CVE-2026-17810

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 after the patch release window
Web content invoking WebGPU APIs from untrusted or newly registered domains
Unexpected outbound HTTP POST requests correlated with visits to pages that initialize WebGPU contexts

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 151.0.7922.72
Monitor browser telemetry for GPU process crashes or anomalies that correlate with WebGPU workloads
Correlate DNS and proxy logs for user navigations to low-reputation domains that request WebGPU features

Monitoring Recommendations

Ingest browser version and update status into the security data lake for continuous version drift analysis
Enable endpoint detection telemetry for child processes spawned from the Chrome GPU process
Track cross-origin data exfiltration patterns in web proxy logs following visits to unknown sites

How to Mitigate CVE-2026-17810

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force restart of Chrome processes after deployment to activate the patched binary
Audit Chromium-based applications and embedded browsers for the fixed Dawn version

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update. The patched build is 151.0.7922.72 for desktop. Enterprises using managed update policies should verify the version rollout through their Chrome Browser Cloud Management console or equivalent MDM tooling.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu toggle or enterprise policy where feasible
Apply the HardwareAccelerationModeEnabled policy set to false for high-risk user groups until patched
Restrict browsing to trusted domains through URL allowlists for sensitive workstations

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows registry policy to disable WebGPU (enterprise)
reg add "HKLM\Software\Policies\Google\Chrome" /v "HardwareAccelerationModeEnabled" /t REG_DWORD /d 0 /f