CVE-2026-79111 in Chrome
Summary
by MITRE • 08/26/2026
Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an improper input validation flaw within the Dawn component of Google Chrome represents a significant breach in browser security boundaries, specifically affecting versions prior to 152.0.7977.65. Dawn serves as Chromium’s implementation of the WebGPU API, which provides low-level access to graphics and compute hardware for web applications. This architectural position grants it elevated privileges relative to standard JavaScript execution contexts, making robust input validation critical. The core technical flaw lies in the failure to adequately sanitize or validate specific inputs passed from untrusted web content before they are processed by the underlying rendering engine. When a remote attacker crafts an HTML page containing maliciously constructed data structures or shader code that bypasses these checks, the browser’s security model is compromised. This allows for out-of-bounds memory access or type confusion errors within the Dawn subsystem, which can be exploited to achieve arbitrary code execution outside the restrictive sandbox environment designed to isolate web content from the host operating system.
From a technical perspective, this vulnerability aligns with CWE-20 Improper Input Validation and often manifests as CWE-119 Memory Corruption vulnerabilities such as buffer overflows or use-after-free conditions within the graphics processing pipeline. The exploitation vector typically involves delivering a specially crafted HTML page via phishing emails, compromised websites, or drive-by downloads. Once rendered by the vulnerable browser version, the malformed input triggers undefined behavior in the Dawn component. Because WebGPU operates at a lower level than traditional Canvas 2D contexts, errors here can lead to direct memory manipulation that escapes the sandbox’s isolation mechanisms. This escalation from web content execution to arbitrary code execution on the host system is classified as a high-severity issue by Chromium security standards due to its potential for complete system compromise without user interaction beyond visiting the malicious page.
The operational impact of this vulnerability is severe, enabling remote attackers to execute arbitrary commands with the privileges of the current user. This can lead to data theft, installation of malware, or use of the compromised machine as part of a botnet. The attack falls under MITRE ATT&CK technique T1203 Exploitation for Client Execution and potentially T1059 Command and Scripting Interpreter if subsequent payload delivery occurs. Users relying on older versions of Chrome are at significant risk during this window before patch deployment, particularly those who frequently visit untrusted or user-generated content sites where such crafted pages might be embedded or linked.
Mitigation strategies primarily involve immediate update to Google Chrome version 152.0.7977.65 or later, which contains the necessary patches for input validation logic within Dawn. Organizations should enforce automated patch management policies to ensure rapid deployment of security updates across all endpoints. Additionally, implementing application whitelisting and restricting browser permissions can limit the impact if a zero-day exploit is encountered before an update is available. Security teams should also monitor network traffic for indicators of compromise associated with known exploitation kits targeting this specific vulnerability class and educate users on recognizing suspicious web content that may attempt to trigger such rendering engine flaws.