CVE-2026-79111: Google Chrome Dawn RCE Vulnerability

CVE-2026-79111 Overview

CVE-2026-79111 is an improper input validation vulnerability in Dawn, the WebGPU implementation used by Google Chrome. The flaw affects Chrome desktop versions prior to 152.0.7977.65. A remote attacker can leverage a crafted HTML page to execute arbitrary code outside the Chrome sandbox. Exploitation requires user interaction, such as visiting a malicious website. Google's Chromium team rated the underlying issue High severity, and the National Vulnerability Database assigned a CVSS 3.1 score of 9.6. The scope change reflects the sandbox escape, which lets attacker-controlled code run with the privileges of the browser process rather than the constrained renderer.

Critical Impact
A single visit to a crafted web page can result in arbitrary code execution outside the Chrome sandbox, effectively yielding remote code execution on the host.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based builds embedding the vulnerable Dawn/WebGPU component
Any downstream browser or application bundling the pre-patch Dawn library

Discovery Timeline

2026-08-25 - CVE-2026-79111 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79111

Vulnerability Analysis

Dawn is the cross-platform implementation of the WebGPU standard used by Chrome to expose GPU compute and rendering to web content. The component parses and forwards GPU commands, descriptors, and buffer layouts supplied by untrusted JavaScript running in a renderer. CVE-2026-79111 stems from missing or insufficient validation of input reaching Dawn, classified under [CWE-20]. Because Dawn interacts with GPU service processes that hold higher privileges than the renderer sandbox, malformed input that bypasses expected constraints can be used to corrupt state outside the sandbox boundary. The result is arbitrary code execution in a process that is not constrained by the renderer's site-isolation and syscall filtering.

Root Cause

The root cause is improper input validation within Dawn's handling of WebGPU API calls originating from web content. Attacker-controlled parameters reach code paths that assume validated data, enabling states that lead to memory or logic corruption in the GPU process. Google has withheld granular technical detail while patch adoption proceeds, tracking the issue as Chromium bug 525683797.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that invokes WebGPU APIs to reach the vulnerable Dawn code path. When a victim using a pre-152.0.7977.65 Chrome build loads the page, the malicious JavaScript issues GPU commands designed to trigger the input validation flaw. Successful exploitation escapes the renderer sandbox and executes attacker code with the privileges of the affected GPU or browser process.

No public proof-of-concept exploit is available at the time of publication, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog. The EPSS probability is 0.373%.

Detection Methods for CVE-2026-79111

Indicators of Compromise

Chrome or chrome.exe (and platform equivalents) spawning unexpected child processes such as command shells, script interpreters, or LOLBins
Outbound connections from the browser process to newly registered or low-reputation domains immediately after WebGPU-heavy page loads
Unexplained crashes or restarts of the GPU process on hosts running Chrome versions prior to 152.0.7977.65

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag any build below 152.0.7977.65
Alert on browser processes writing executables, scheduled tasks, or persistence keys, which are consistent with post-sandbox-escape behavior
Correlate GPU process crashes with subsequent anomalous process creation from the browser parent process

Monitoring Recommendations

Ingest endpoint process, network, and file telemetry into a central analytics platform to enable cross-signal correlation for browser exploitation chains
Baseline normal Chrome child-process behavior per user population so that deviations following web browsing are surfaced quickly
Monitor vendor advisories and update the Chrome fleet version watchlist as new stable channel builds are published

How to Mitigate CVE-2026-79111

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome after the update so the patched binaries are loaded; pending updates do not take effect until relaunch
Push the update to managed fleets via enterprise policy or MDM rather than relying on user-initiated updates
Audit Chromium-based third-party browsers and Electron applications for embedded Dawn versions and update them as vendors ship fixes

Patch Information

Google addressed CVE-2026-79111 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Additional tracking is available in the Chromium Issue Tracker #525683797. Users on the Stable channel should receive 152.0.7977.65 or later automatically, but a browser restart is required to complete installation.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu and related flags, or by policy where supported, until patching completes
Restrict browsing to trusted sites through enterprise URL allow-lists for high-risk user groups
Deploy Chrome enterprise policies to enforce automatic updates and prevent users from downgrading or disabling updates

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: check version via registry (PowerShell)
Get-ItemProperty 'HKLM:\SOFTWARE\Google\Update\Clients\*' |
  Where-Object { $_.name -eq 'Google Chrome' } |
  Select-Object name, pv

# Enterprise policy example (Linux JSON): enforce auto-update
# /etc/opt/chrome/policies/managed/update_policy.json
{
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true,
  "MetricsReportingEnabled": true
}