Remote Code Execution in Google Chrome WebGPU

CVE-2026-4678

What is CVE-2026-4678?

A vulnerability in the WebGPU implementation of Google Chrome prior to version 146.0.7680.165 enables remote attackers to execute arbitrary code within the browser's sandbox environment. This security flaw arises from improper memory management, specifically a use after free condition, which can be exploited via specially crafted HTML pages. By leveraging this vulnerability, attackers could potentially gain unauthorized access to sensitive data or execute malicious actions on the user's system.

References