CVE-2026-7973: Google Chrome RCE Vulnerability

CVE-2026-7973 Overview

CVE-2026-7973 is an integer overflow vulnerability in the Dawn graphics component of Google Chrome on Windows. The flaw affects Chrome versions prior to 148.0.7778.96. A remote attacker can trigger the overflow by serving a crafted HTML page to a target user. Successful exploitation allows the attacker to potentially escape the Chrome sandbox, breaking the primary isolation boundary that protects the operating system from untrusted web content. The vulnerability is tracked under [CWE-472] and was disclosed by Google through the Chrome stable channel update.

Critical Impact
A successful sandbox escape from a malicious web page can give an attacker code execution outside Chrome's renderer sandbox on Windows hosts.

Affected Products

Google Chrome on Windows prior to 148.0.7778.96
Microsoft Windows hosts running vulnerable Chrome builds
Chromium-based workflows leveraging the Dawn WebGPU implementation

Discovery Timeline

2026-05-06 - CVE-2026-7973 published to NVD
2026-05-06 - Last updated in NVD database
2026-05 - Google releases stable channel update for desktop addressing the issue

Technical Details for CVE-2026-7973

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform implementation of WebGPU used by Chromium to expose GPU functionality to web content. Dawn translates WebGPU API calls from the renderer into native graphics backends such as Direct3D on Windows. An integer overflow in this translation path corrupts size or offset calculations used for GPU resource handling. When the corrupted values flow into downstream allocations or memory operations, they create the conditions for memory corruption inside a privileged Chrome process.

Because Dawn runs in the GPU process rather than the more constrained renderer sandbox, a controlled overflow here is positioned to bypass renderer isolation. The result is a potential sandbox escape, where attacker-controlled JavaScript executes operations whose effects extend beyond the renderer process boundary. User interaction is required, since the victim must load the crafted HTML page.

Root Cause

The root cause is improper validation of arithmetic on untrusted size or count values supplied through the WebGPU interface. Operations that compute buffer dimensions, descriptor sizes, or element counts wrap around the integer range when attacker-controlled inputs are large enough. The wrapped value is then trusted by subsequent code paths, leading to undersized allocations or out-of-bounds access in Dawn-managed structures.

Attack Vector

Exploitation is network-based and requires only that a user visits a malicious or compromised web page. The page issues a crafted sequence of WebGPU calls through Dawn that triggers the overflow. From the corrupted state, an attacker chains the primitive into a sandbox escape on Windows, achieving code execution in the context of the GPU process. No verified public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available for this issue. See the Chromium Issue Tracker entry and the Chrome Releases advisory for additional technical context.

Detection Methods for CVE-2026-7973

Indicators of Compromise

Chrome browser processes on Windows reporting GPU process crashes correlated with WebGPU activity from untrusted origins.
Unexpected child processes spawned by chrome.exe GPU processes shortly after rendering external HTML content.
Outbound connections from Chrome GPU process memory regions to attacker infrastructure following visits to unfamiliar domains.

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build below 148.0.7778.96.
Hunt for anomalous GPU process behavior, including unusual handle creation, memory mapping, or code execution outside expected Dawn modules.
Correlate browser crash telemetry with web navigation logs to identify clusters of users hitting suspicious pages.

Monitoring Recommendations

Forward Chrome crash and stability telemetry to a central log platform for analysis.
Monitor endpoint EDR telemetry for process lineage anomalies originating from chrome.exe GPU subprocesses.
Track DNS and proxy logs for newly observed domains delivering WebGPU-heavy content to monitored users.

How to Mitigate CVE-2026-7973

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 148.0.7778.96 or later.
Validate that managed update channels and Chrome auto-update are functional and not blocked by group policy.
Restart Chrome on user systems after the update is delivered, since pending versions only apply on relaunch.

Patch Information

Google addressed CVE-2026-7973 in the Chrome stable channel for desktop. The fixed version on Windows is 148.0.7778.96. Refer to the Chrome Releases stable channel update for the full advisory and to the Chromium Issue Tracker entry for issue metadata. Chromium-based browsers that embed Dawn should adopt the corresponding upstream fix.

Workarounds

Restrict access to untrusted web content using web filtering or browser isolation until patching completes.
Disable WebGPU through enterprise policy where business requirements allow, reducing exposure to the Dawn code path.
Apply least-privilege account configurations on Windows to limit the impact of a successful sandbox escape.

bash

# Verify deployed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update check via Chrome (run as the user)
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1