CVE-2026-17867: Google Chrome Dawn RCE Vulnerability

CVE-2026-17867 Overview

CVE-2026-17867 is an input validation vulnerability in Dawn, the WebGPU implementation used by Google Chrome. Versions of Chrome prior to 151.0.7922.72 fail to properly validate untrusted input passed through the Dawn component. A remote attacker can craft a malicious HTML page that triggers the flaw and potentially escapes the Chrome sandbox. Google has rated the Chromium security severity as Medium. The weakness is categorized as [CWE-20] Improper Input Validation.

Critical Impact
A successful exploit could allow a remote attacker to break out of the Chrome renderer sandbox from a crafted web page, expanding access beyond the browser's isolation boundary.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable Dawn/WebGPU component
Any application using the affected Dawn build for WebGPU rendering

Discovery Timeline

2026-07-30 - CVE-2026-17867 published to NVD
2026-07-30 - Last updated in NVD database
Fix shipped in the Chrome Stable channel update referenced in the Google Chrome Stable Update advisory

Technical Details for CVE-2026-17867

Vulnerability Analysis

Dawn is the cross-platform implementation of the WebGPU API that Chrome uses to expose GPU acceleration to web content. The vulnerability stems from insufficient validation of untrusted input handled by Dawn when processing WebGPU commands originating from a web page. Because Dawn operates close to the GPU driver boundary and interacts with the GPU process, malformed input that bypasses validation can influence code paths outside the renderer sandbox. The result is a potential sandbox escape driven entirely by JavaScript and WebGPU calls delivered through an ordinary HTML page.

Root Cause

The root cause is improper input validation [CWE-20] within Dawn. Attacker-controlled parameters supplied through WebGPU are not adequately checked before being consumed by lower-level GPU handling logic. This validation gap creates the conditions for state confusion or unsafe operations to occur in a more privileged process context.

Attack Vector

Exploitation is remote and requires only that a target visit an attacker-controlled or compromised web page in a vulnerable Chrome build. The crafted page issues WebGPU calls via Dawn that carry the malformed input needed to reach the vulnerable code path. No authentication is required, and user interaction is limited to loading the page. Technical specifics have not been publicly disclosed. See the Chromium Issue Tracker Entry for restricted upstream details.

Detection Methods for CVE-2026-17867

Indicators of Compromise

Chrome or Chromium processes with versions below 151.0.7922.72 still running in the environment after the patch release
Unexpected child processes spawned from the Chrome GPU process (chrome.exe --type=gpu-process or the platform equivalent)
Renderer or GPU process crashes correlated with visits to unfamiliar sites using WebGPU

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome build older than 151.0.7922.72.
Monitor endpoint telemetry for anomalous process lineage originating from the Chrome GPU process, such as shell or scripting engines being launched as children.
Correlate browser crash reports with network telemetry to identify pages that repeatedly trigger GPU process termination.

Monitoring Recommendations

Ingest browser version and update status from software inventory tools into your SIEM for continuous compliance checks.
Track DNS and web proxy logs for connections to newly registered or low-reputation domains delivering WebGPU content.
Alert on Chrome auto-update failures, which can leave endpoints exposed to known browser vulnerabilities.

How to Mitigate CVE-2026-17867

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched Dawn component is loaded.
Update Chromium-based browsers and embedded frameworks (Edge, Brave, Electron, CEF) as soon as their vendors release rebased builds.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fixed version is 151.0.7922.72. Enterprises managing Chrome through group policy or MDM should confirm that the update policy allows the new build to deploy within their standard patch window.

Workarounds

Disable WebGPU in Chrome via enterprise policy where the feature is not required, reducing exposure to Dawn code paths.
Restrict browsing to trusted sites through URL filtering until the patch is fully deployed.
Enforce site isolation and keep Chrome's sandboxing features enabled to raise the cost of exploitation.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: check version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Example Chrome enterprise policy to disable WebGPU (JSON on macOS/Linux managed prefs)
{
  "WebGPUEnabled": false
}