CVE-2026-17995: Google Chrome Dawn Out of Bounds Read Flaw

CVE-2026-17995 Overview

CVE-2026-17995 is an out-of-bounds read vulnerability in the Dawn component of Google Chrome. Dawn is Chromium's open-source implementation of the WebGPU standard, providing GPU access to web content. A remote attacker can trigger the flaw by serving a crafted HTML page that causes Chrome to read memory outside allocated buffers. Google classified the Chromium security severity as Low. The issue affects Chrome versions prior to 151.0.7922.72 and is tracked under CWE-125.

Critical Impact
A remote attacker can read out-of-bounds memory in the Chrome renderer through a malicious web page, potentially exposing sensitive process memory contents to attacker-controlled JavaScript.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers that embed the vulnerable Dawn WebGPU implementation
Applications bundling affected Chromium builds through frameworks such as Electron or CEF

Discovery Timeline

2026-07-30 - CVE-2026-17995 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17995

Vulnerability Analysis

The vulnerability resides in Dawn, the Chromium subsystem that implements the WebGPU API. Dawn translates WebGPU calls from JavaScript into native graphics API commands for Vulkan, Direct3D, or Metal. An out-of-bounds read (CWE-125) occurs when Dawn accesses memory beyond the bounds of a validated buffer or resource. The read leaks adjacent memory contents back into a context reachable by the attacker's web page. Chromium security engineers labeled the severity Low, indicating the memory disclosure is constrained and not directly exploitable for code execution. Further technical context is available in the Chromium Issue Tracker entry.

Root Cause

The root cause is missing or incorrect bounds validation on a buffer, texture, or command parameter processed by Dawn. WebGPU exposes GPU resources to untrusted JavaScript, so Dawn must validate every offset, size, and index before dereferencing memory. When a size or offset value is not correctly checked against the underlying allocation, Dawn reads bytes outside the intended region.

Attack Vector

Exploitation requires an attacker to lure a victim to a crafted HTML page in a vulnerable Chrome build. The page issues a sequence of WebGPU calls designed to trigger the flawed code path in Dawn. Because the attack executes entirely inside standard web content, no user interaction beyond visiting the page is required. See the Chrome Release Update for release-level context.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the Chromium issue tracker referenced above; researchers should consult that source rather than rely on synthetic examples.

Detection Methods for CVE-2026-17995

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints
Renderer processes crashing or generating unexpected memory access telemetry while rendering WebGPU content
Outbound connections to unknown domains delivering pages that invoke WebGPU APIs (navigator.gpu)

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across the fleet and flag any build below 151.0.7922.72
Monitor browser process telemetry for abnormal renderer memory reads, crashes, or GPU process faults following navigation events
Correlate web proxy logs with browser telemetry to identify sessions that loaded pages exercising WebGPU on out-of-date browsers

Monitoring Recommendations

Ingest browser version and update-status events into your SIEM to track patch compliance over time
Alert on renderer or GPU process crashes clustered around specific origins, which may indicate active exploitation attempts
Track WebGPU feature usage through browser telemetry where available to identify unusual invocation patterns

How to Mitigate CVE-2026-17995

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms
Update Chromium-based browsers and embedded runtimes (Edge, Brave, Electron applications) as vendor patches become available
Enforce browser update policies through group policy, MDM, or endpoint management tools to prevent version drift

Patch Information

Google released the fix in the Chrome Stable channel at version 151.0.7922.72. Refer to the Chrome Release Update for the complete list of addressed issues in this build. Downstream Chromium projects should pick up the corresponding Dawn commit referenced in the Chromium Issue Tracker entry.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu setting or enterprise policy where the feature is not required
Restrict access to untrusted sites through web filtering until all endpoints are patched
Deploy site isolation and strict enterprise browser policies to reduce exposure of sensitive data in renderer processes

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version