CVE-2026-106375

Executive Summary

CVE-2026-106375 is an incomplete cleanup vulnerability (CWE-459) in Dawn, the WebGPU implementation shipped in Google Chrome, affecting versions prior to 155.0.8059.39. A remote attacker can trigger the flaw by luring a user to a crafted HTML page, potentially achieving arbitrary code execution outside the browser sandbox. The CVSS v3.1 base score of 9.6 reflects network reachability, no privileges required, and high confidentiality, integrity, and availability impact with an unchanged-scope/scope-changed vector of 9.6; the Chromium security severity is rated Medium, indicating elevated severity from a sandbox-escape context but constrained practical exploitability.

Technical Analysis

Dawn is the open-source, cross-platform implementation of the WebGPU standard used by Chromium-based browsers to expose GPU functionality to web content. WebGPU operates on the boundary between renderer and GPU processes, and its memory management relies on correct lifetime handling of GPU resources, command buffers, and shared allocations. CWE-459 (Incomplete Cleanup) describes a condition where a resource is not properly released or reset at the end of its lifecycle, leaving residual state or stale references that can be reused in an unintended context.

In this CVE, the NVD description states that "Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page." The critical detail is the phrase "outside the sandbox." Chromium's security model relies on process isolation: the renderer (which parses untrusted HTML and executes JavaScript) is untrusted and sandboxed, while the GPU process and browser process hold greater privileges. A vulnerability in Dawn that permits code execution outside the renderer sandbox therefore implies a sandbox-escape chain, in which GPU-side memory corruption or improper resource teardown enables an attacker to influence or execute code in a more privileged process.

Because cleanup is incomplete, the most plausible mechanism class is a use-after-free or dangling-resource condition: memory or a GPU resource freed or reset incompletely during object destruction remains reachable, and a subsequent WebGPU operation can operate on stale state. This is a well-understood attack pattern in browser GPU stacks, where the GPU process maintains a command stream and shared memory buffers across contexts. The NVD entry does not enumerate specific functions, classes, or entry points, and no CNA title or technical advisory detail was provided; therefore the exact vulnerable function and the precise trigger sequence cannot be determined from the available data. No public PoC, exploit code, or Nuclei template was identified, and the vulnerability has not been scored by FIRST.org (EPSS pending) and is not listed in CISA KEV.

The attack surface is WebGPU content delivered through the browser. Any web page capable of submitting WebGPU workloads can reach Dawn inside the GPU process. The vulnerability requires user interaction in the form of visiting the crafted page (UI:R in the vector), but once triggered, the attacker's objective is code execution in a context not constrained by the renderer sandbox. The scope change (S:C) and high C/I/A impacts in the provided vector are consistent with a sandbox-escape class issue rather than a simple renderer-only memory corruption.

Exploitation Scenarios

No public PoC or in-the-wild exploit is available for this CVE. The following chain is described strictly at the vulnerability-class level and should be treated as an inference from CWE-459 in a WebGPU sandbox-escape context, not as a reproduced exploit.

1. Reconnaissance and target identification. The attacker identifies a browser fleet running Chrome versions earlier than 155.0.8059.39. Because WebGPU is enabled by default in recent Chrome releases on supported platforms, target selection depends primarily on browser version rather than on any special configuration. Attackers may combine version fingerprinting with web-based delivery or use watering-hole or malvertising infrastructure to reach affected users.

2. Triggering the flaw class. The attacker hosts a crafted HTML page that specifies malicious WebGPU workloads. Per the description, the flaw is incomplete cleanup in Dawn. At the class level, this means the malicious page causes a WebGPU resource, command buffer, or memory region to be released or reset inadequately; the residual state can then be reused or referenced after the intended lifecycle has ended. The crafted page is the sole delivery mechanism described by NVD, so no network service exploitation or authentication bypass is involved.

3. Payload and execution method. Because the flaw stems from incomplete cleanup, the class-level exploitation goal is to convert stale or improperly released state into memory corruption within the GPU process. From there, the attacker seeks to escape the sandbox and execute arbitrary code in a more privileged process. The NVD description explicitly frames the outcome as potential execution of arbitrary code outside the sandbox, which is the strongest technical claim supported by the data. The specific primitives — heap shaping, object reuse timing, or particular WebGPU API sequences — are not disclosed and must not be assumed.

4. Post-exploitation impact. Successful exploitation at the class level yields code execution in a process that is not subject to renderer sandbox constraints. Depending on host configuration, this can expose user data and local files reachable by the compromised process, enable persistence or lateral movement from the browser host, and undermine the security boundary that Chrome relies on for untrusted web content. The CVSS subscores for confidentiality, integrity, and availability are all High, and scope is Changed, consistent with an impact that extends beyond the vulnerable component and into the underlying operating system context.

Impact Assessment

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H with a base score of 9.6 indicates that the vulnerability is remotely triggerable over the network with low attack complexity, requires no privileges, and requires user interaction. The scope-changed classification is significant: it means the exploitation of Dawn can affect resources beyond the vulnerable component, which is exactly the sandbox-escape scenario described by NVD. The High C/I/A ratings indicate a worst-case impact of full compromise of confidentiality, integrity, and availability on the affected host.

Affected systems are Chrome installations before 155.0.8059.39 that expose WebGPU through Dawn. Because Dawn is a shared component, organizations using Chromium-derived browsers or embedded Chromium in desktop applications may also be exposed depending on how the implementation is vendored and versioned; however, the provided data only confirms the Chrome version range from the NVD description, and the affected package set (OSV) was not provided. The absence of CISA KEV listing, EPSS scoring, and public exploit code moderates the immediate operational risk: there is no current evidence of mass exploitation. The Medium Chromium security severity label further suggests the vendor assessed the issue as non-critical within its severity taxonomy, even though the CVSS base score is 9.6.

Blast radius is significant for any environment that allows browser traffic from untrusted sources. Since delivery requires only a crafted HTML page and user interaction, endpoint users are the primary exposure vector. Organizations with strict browser patching and no WebGPU-dependent workflows retain a manageable risk profile, provided they can upgrade to 155.0.8059.39.

Detection Guidance

Sigma Rule

This rule detects likely delivery of WebGPU/HTML content that could target Dawn, and attempts to correlate browser process anomalies. It is heuristic: because no PoC exists, it cannot match known-bad strings.

title: Suspicious WebGPU Content and Chrome Renderer Sandbox Activity
id: 6b6b8c2a-4b1e-4f0c-9a3e-1c2d3e4f5a6b
status: experimental
description: Detects web content referencing WebGPU alongside Chrome version fingerprints below 155.0.8059.39
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106375
author: valtersit.com
date: 2026-01-01
logsource:
  category: proxy
detection:
  selection_webgpu:
    cs-uri-query|contains:
      - 'webgpu'
      - 'adapter.requestDevice'
      - 'navigator.gpu'
  selection_html:
    cs-method: 'GET'
    cs-uri-stem|endswith:
      - '.html'
      - '.htm'
  condition: selection_webgpu and selection_html
falsepositives:
  - Legitimate WebGPU demos, documentation, and developer tooling
level: low

YARA Rule

YARA scanning is applied to memory dumps or files that may contain WebGPU JavaScript used in a delivery chain. It looks for WebGPU API entry points combined with heap-shaping loops; it is a hunting aid, not a signature for CVE-2026-106375 itself.

rule WebGPU_Dawn_Exploit_Scaffold
{
    meta:
        description = "Heuristic hunt for WebGPU-based exploit scaffolding targeting Dawn (CVE-2026-106375)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106375"

    strings:
        $gpu1 = "navigator.gpu" ascii wide
        $gpu2 = "requestAdapter" ascii wide
        $gpu3 = "requestDevice" ascii wide
        $gpu4 = "createBuffer" ascii wide
        $gpu5 = "createCommandEncoder" ascii wide
        $heap1 = "Array(" ascii wide
        $heap2 = "ArrayBuffer(" ascii wide
        $heap3 = "new Uint8Array" ascii wide

    condition:
        3 of ($gpu*) and any of ($heap*)
}

Suricata IDS Rule

Detects HTTP delivery of HTML pages containing WebGPU execution keywords.

alert http any any -> any any (msg:"CVE-2026-106375 Possible WebGPU Dawn Exploit Delivery"; flow:established,to_client; http.method; content:"GET"; http.header; content:"Accept"; content:"text/html"; http.response_body; content:"navigator.gpu"; http.response_body; content:"requestDevice"; classtype:attempted-user; sid:2026106375; rev:1; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106375;)

Elastic Detection

Detects Chrome GPU/renderer process anomalies on endpoints where the browser version is below the fixed release, correlated with GPU process crashes.

process where event.type in ("start", "end", "info")
  and process.name in ("chrome.exe", "Google Chrome", "chrome")
  and process.args != null
  and (
    process.command_line : "*--type=gpu-process*"
    or process.command_line : "*--type=renderer*"
  )
  and event.action != null

Splunk SPL Query

Detects endpoint telemetry where an outdated Chrome build coexists with GPU process crash indicators.

index=endpoint OR index=sysmon
(process_name=chrome.exe OR process_name="Google Chrome")
| rex field=process_path "(?<chrome_version>\d+\.\d+\.\d+\.\d+)"
| where (chrome_version < "155.0.8059.39" AND chrome_version != "")
| eval risk=if(command_line LIKE "%--type=gpu-process%", "gpu-process", if(command_line LIKE "%--type=renderer%", "renderer", "other"))
| stats count values(risk) as process_role by host, user, chrome_version
| where count > 0
| sort - count

Wazuh OSSEC Rule

Detects GPU process crash/restart patterns in Chrome on managed endpoints, which may indicate exploitation attempts of the incomplete-cleanup condition.

<group name="cve-2026-106375,chrome,webgpu,">
  <rule id="1063750" level="7">
    <if_sid>61600</if_sid>
    <field name="win.eventdata.image">chrome\.exe</field>
    <field name="win.eventdata.commandLine">--type=gpu-process</field>
    <description>CVE-2026-106375: Chrome GPU process activity on system with potentially vulnerable version</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
  <rule id="1063751" level="10">
    <if_sid>61600</if_sid>
    <field name="win.eventdata.image">chrome\.exe</field>
    <field name="win.eventdata.commandLine">--type=gpu-process</field>
    <match>crash</match>
    <description>CVE-2026-106375: Possible Dawn incomplete-cleanup exploitation - GPU process crash</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate mitigations:

1. Assume exposure if Chrome is below 155.0.8059.39. Where immediate upgrade is possible, prioritize it despite the absence of a tracked vendor patch source; the NVD description identifies 155.0.8059.39 as the version in which the flaw was addressed.
2. Where upgrades are delayed, consider disabling WebGPU via enterprise policy (chrome://policy WebGPU feature control) on managed endpoints to remove the attack surface, and evaluate blocking untrusted WebGPU content at the network layer as a temporary control.
3. Harden browser usage: enforce site isolation, keep renderer sandboxing enabled, restrict high-risk browsing to managed profiles, and increase monitoring of GPU process crashes.

Patch and upgrade steps:

1. Verify the installed Chrome version and confirm it is at or above 155.0.8059.39.
2. Apply the Chrome update through the standard update channel (managed auto-update, MSI/PKG, or vendor repository) and restart the browser.
3. Audit Chromium-embedded applications for their bundled Chromium/Dawn version, since the CVE data only confirms a Chrome version range and does not enumerate embedded deployments.

Long-term hardening:

1. Maintain a browser patch SLA with short timelines for high-CVSS client-side issues, prioritizing sandbox-escape classes.
2. Track Chromium/Dawn security advisories and the WebGPU specification and implementation changelogs for cleanup and lifetime-management fixes.
3. Deploy endpoint and network detection for WebGPU-based exploit delivery and GPU process anomaly correlation as covered in the detection section.
4. Reduce reliance on a single browser security boundary by combining sandbox enforcement with application allow-listing and least-privilege endpoint configuration.

References

1. NVD — CVE-2026-106375: https://nvd.nist.gov/vuln/detail/CVE-2026-106375
2. CWE-459: Incomplete Cleanup — https://cwe.mitre.org/data/definitions/459.html
3. Chromium Security — Stable Channel Update page (advisory for Chrome 155.0.8059.39): https://chromereleases.googleblog.com/
4. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
5. CISA KEV Catalog (CVE-2026-106375 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-106375 in the provided data. The CVE is not listed in CISA KEV, no public PoC exists, and FIRST.org has not yet assigned an EPSS score.