CVE-2026-17946: Google Chrome Dawn Information Disclosure

CVE-2026-17946 Overview

CVE-2026-17946 is an uninitialized memory use vulnerability in the Dawn component of Google Chrome. Dawn is Chromium's open-source implementation of the WebGPU standard, providing hardware-accelerated graphics to web content. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can read potentially sensitive information from process memory by delivering a crafted HTML page. Google classifies the Chromium security severity as Low, because exploitation requires prior renderer compromise. The vulnerability is tracked as [CWE-457: Use of Uninitialized Variable].

Critical Impact
An attacker with a compromised renderer can extract residual process memory contents through Dawn, enabling information disclosure that supports sandbox escape and further exploitation chains.

Affected Products

Google Chrome (Desktop) versions prior to 151.0.7922.72
Chromium-based browsers embedding the Dawn/WebGPU implementation prior to the fixed revision
Applications shipping the vulnerable Dawn library

Discovery Timeline

2026-07-30 - CVE-2026-17946 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17946

Vulnerability Analysis

The vulnerability resides in Dawn, the WebGPU implementation used by Chrome to broker GPU commands between web content and the underlying graphics stack. Dawn allocates buffers and structures on behalf of GPU operations, and one or more of these allocations are not fully initialized before being read. When the renderer process is already under attacker control, the attacker can trigger the vulnerable code path with a crafted HTML page that issues specific WebGPU calls. The resulting read returns residual bytes from previously used heap memory. This memory can contain pointers, tokens, or other artifacts useful for bypassing address space layout randomization (ASLR) or staging a sandbox escape.

Root Cause

The root cause is a Dawn code path that consumes a memory region without guaranteeing full initialization on all execution branches, matching the pattern described by [CWE-457]. Values that should have been written by an initialization routine remain populated with prior heap contents, and those contents flow back to the caller. Refer to the Chromium Issue Tracker Entry for tracking details.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the Chrome renderer process, typically by chaining a separate renderer-side flaw. Second, the attacker delivers or executes a crafted HTML page that drives Dawn through the vulnerable WebGPU code path. The information disclosure is then used to strengthen a subsequent exploit stage, such as escaping the renderer sandbox. There are no reports of exploitation in the wild, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept code has been released. Technical details are limited to the vendor advisory; see the Google Chrome Update Announcement.

Detection Methods for CVE-2026-17946

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints.
Unexpected renderer process crashes or GPU process errors correlated with WebGPU-heavy pages.
Outbound connections from browser processes to attacker-controlled hosts following visits to unknown WebGPU-enabled pages.

Detection Strategies

Inventory installed Chrome and Chromium-derivative browser versions across the fleet and flag builds below 151.0.7922.72.
Monitor renderer and GPU process telemetry for anomalous child process behavior, memory access patterns, or crash signatures involving dawn modules.
Correlate browser exploitation attempts with subsequent process injection, credential access, or lateral movement events indicative of a chained sandbox escape.

Monitoring Recommendations

Ingest browser process telemetry and Chrome update state into the SIEM for continuous version compliance checks.
Alert on renderer processes spawning unusual child processes or writing to sensitive file system paths.
Track visits to newly registered or low-reputation domains that serve WebGPU content following a known compromise.

How to Mitigate CVE-2026-17946

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later across all endpoints and managed devices.
Force-restart browser sessions after deployment so the patched binary is loaded into memory.
Update all Chromium-based browsers and embedded Chromium runtimes once vendors ship builds incorporating the fixed Dawn revision.

Patch Information

Google addressed the flaw in Chrome Stable channel 151.0.7922.72. Details are published in the Google Chrome Update Announcement, and the underlying issue is tracked in the Chromium Issue Tracker Entry.

Workarounds

Disable WebGPU via enterprise policy where hardware-accelerated graphics for web content is not required.
Restrict browsing on high-value hosts to trusted domains through URL filtering until the patch is deployed.
Enforce site isolation and standard Chrome security policies to raise the cost of the prerequisite renderer compromise.

bash

# Windows enterprise policy example: disable WebGPU until patch rollout completes
reg add "HKLM\Software\Policies\Google\Chrome" /v "WebGPUEnabled" /t REG_DWORD /d 0 /f