CVE-2026-18017: Google Chrome Dawn Use After Free Flaw

CVE-2026-18017 Overview

CVE-2026-18017 is a use-after-free vulnerability [CWE-416] in the Dawn component of Google Chrome. Dawn is Chrome's cross-platform WebGPU implementation that translates WebGPU API calls into native graphics operations. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the issue by serving a crafted HTML page that triggers execution of arbitrary code within the Chrome sandbox. Google Chromium rates the security severity as Low, reflecting the sandbox containment boundary.

Critical Impact
A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page that abuses Dawn's WebGPU handling.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable Dawn/WebGPU builds
Desktop platforms shipping the Chrome Stable channel before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-18017 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18017

Vulnerability Analysis

The vulnerability resides in Dawn, the Chrome component that implements the WebGPU API. Dawn manages GPU resource lifetimes on behalf of web content, tracking device objects, command encoders, buffers, and textures. A use-after-free condition occurs when Dawn continues to reference a GPU-related object after its backing memory has been released. Attackers can shape the freed allocation using scripted WebGPU calls from an attacker-controlled page. Reusing the dangling pointer during subsequent Dawn operations enables control of function pointers or object metadata, leading to arbitrary code execution inside the renderer or GPU process sandbox.

Root Cause

The root cause is improper object lifetime management inside Dawn [CWE-416]. Reference counting or ownership tracking fails to synchronize object destruction with pending operations that still hold the pointer. See the Chromium Issue Tracker Entry for developer-tracked context.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page issues sequenced WebGPU calls that free a Dawn object then reuse it. Successful exploitation yields code execution inside the sandbox, which an attacker would typically chain with a separate sandbox escape to fully compromise the host. No verified public proof-of-concept code is available.

// No verified exploit code is publicly available for CVE-2026-18017.
// See the Chromium Issue Tracker for developer-side technical details.

Detection Methods for CVE-2026-18017

Indicators of Compromise

Chrome renderer or GPU process crashes with heap corruption signatures shortly after visiting an untrusted site
Unexpected child process spawning from chrome.exe following browser-based user activity
Outbound connections from Chrome processes to newly registered or low-reputation domains hosting WebGPU content

Detection Strategies

Monitor endpoint telemetry for Chrome versions below 151.0.7922.72 and flag hosts pending update
Correlate browser crash dumps referencing Dawn or WebGPU modules with recent navigation history
Inspect HTTP responses for HTML content that instantiates WebGPU adapters and issues rapid resource destruction sequences

Monitoring Recommendations

Track Chrome auto-update deployment status across managed fleets
Alert on anomalous process creation chains rooted in the Chrome GPU process
Retain browser telemetry and crash reports for retrospective hunts against Dawn-related stack frames

How to Mitigate CVE-2026-18017

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binaries are loaded
Audit third-party Chromium-based browsers for equivalent Dawn/WebGPU updates

Patch Information

Google released the fix in Chrome Stable 151.0.7922.72. Deployment details are documented in the Chrome Desktop Update Announcement. Enterprise administrators should verify update channels and force reinstallation where auto-update is disabled.

Workarounds

Disable WebGPU via the --disable-features=WebGPU command-line switch or enterprise policy until patching completes
Restrict browsing to trusted origins using enterprise URL allow-lists
Enforce site isolation and sandbox hardening policies to limit exploit chaining opportunities

bash

# Enterprise policy example: disable WebGPU pending patch rollout
# Linux managed policy JSON (/etc/opt/chrome/policies/managed/disable-webgpu.json)
{
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"],
  "HardwareAccelerationModeEnabled": false
}