CVE-2026-79221: Google Chrome Dawn Information Disclosure

CVE-2026-79221 Overview

CVE-2026-79221 is an uninitialized resource vulnerability in Dawn, the WebGPU implementation used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the issue by serving a crafted HTML page to a victim browser. Successful exploitation allows the attacker to read memory contents inside the Chrome sandbox. Chromium engineers rated the security severity as Medium. The weakness is classified under [CWE-908: Use of Uninitialized Resource].

Critical Impact
Remote attackers can trigger memory disclosure inside the Chrome sandbox by luring users to a malicious page rendered by the Dawn/WebGPU stack.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding Dawn/WebGPU builds before the fixed revision
Downstream distributions bundling the vulnerable Dawn component

Discovery Timeline

2026-08-25 - CVE-2026-79221 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79221

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform WebGPU implementation shipped inside Chrome. Dawn translates WebGPU API calls from web content into native graphics operations on Direct3D, Metal, or Vulkan backends. The defect allows a resource to be used before it is fully initialized, exposing residual memory contents to the caller. Because WebGPU is reachable from JavaScript on any origin, an attacker only needs to render a crafted HTML page in the target browser. The read remains bounded by the renderer sandbox, but leaked memory can include pointers, tokens, or other cross-origin data useful for chaining further exploits.

Root Cause

The root cause is improper initialization of a Dawn-managed graphics resource before it is read back into script-visible buffers. When JavaScript queries the resource through the WebGPU API, Dawn returns memory whose contents were never zeroed or populated by a producer. This pattern maps directly to CWE-908. Public references are limited to the Chromium issue tracker entry #532923954 and the Google Chrome Stable Update, which does not disclose exploitation specifics.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled page or a compromised site loading malicious script. The page issues WebGPU calls that allocate and read the affected resource without initializing it first. No user interaction beyond page navigation is required, and no elevated privileges are needed. The disclosed memory stays inside the renderer sandbox, so an attacker typically pairs this bug with a sandbox escape or uses it for information leakage to defeat address space layout randomization (ASLR).

No public proof-of-concept code is available. Technical details are described in prose because verified exploit code has not been published.

Detection Methods for CVE-2026-79221

Indicators of Compromise

Chrome browser processes at versions below 152.0.7977.65 loading untrusted WebGPU content
Outbound connections from browser processes to newly registered or low-reputation domains hosting WebGPU-heavy pages
Unexpected GPU process crashes or renderer telemetry anomalies correlated with visits to unknown sites

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag anything below 152.0.7977.65
Monitor web proxy or DNS logs for user navigation to pages that heavily invoke WebGPU APIs from untrusted origins
Correlate browser crash reports with URL history to surface pages that trigger renderer instability

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for version and behavior analytics
Alert on execution of Chrome binaries whose reported version predates the patched build
Track GPU process (--type=gpu-process) and renderer child process behavior for anomalous memory access patterns

How to Mitigate CVE-2026-79221

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Force-restart browser sessions after deployment so the patched binary is loaded into memory
Audit Chromium-based applications and embedded browser frameworks for Dawn updates and apply vendor patches

Patch Information

Google addressed CVE-2026-79221 in the Chrome Stable channel release documented in the Chrome Releases blog. The fix ships in Chrome 152.0.7977.65 and later. Enterprises using managed update channels should confirm rollout status through their configuration management tooling. Additional context is tracked in Chromium Issue #532923954.

Workarounds

Disable WebGPU via the chrome://flags/#enable-unsafe-webgpu and related policy settings until patched builds are deployed
Restrict browsing to trusted sites through enterprise web filtering while endpoints remain unpatched
Apply browser hardening policies that disable experimental graphics features on high-risk user groups

bash

# Configuration example: enforce minimum Chrome version via enterprise policy (Linux)
cat >/etc/opt/chrome/policies/managed/cve-2026-79221.json <<'EOF'
{
  "BrowserSwitcherEnabled": false,
  "DefaultWebUsbGuardSetting": 2,
  "WebGpuEnabled": false,
  "TargetVersionPrefix": "152.0.7977.65"
}
EOF