CVE-2026-13825
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An uninitialized use vulnerability in the Dawn component in Google Chrome prior to 150.0.7871.47 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Risk Assessment
An attacker could remotely cause a browser crash or potentially execute arbitrary code, posing a high risk to user data confidentiality and integrity.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Dawn
See all- CVE-2026-14424Critical
A use-after-free vulnerability exists in the Dawn component of Google Chrome on Mac prior to version 150.0.7871.46. A remote attacker could exploit a crafted HTML page to potentially achieve a sandbox escape.
- CVE-2026-14420Critical
A vulnerability in the Dawn component of Google Chrome prior to 150.0.7871.46 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue is an out-of-bounds read and write.
- CVE-2026-14417Critical
A use-after-free vulnerability in Dawn in Google Chrome prior to 150.0.7871.46 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-14416Critical
An out-of-bounds read vulnerability in the Dawn component of Google Chrome prior to version 150.0.7871.46 could allow a remote attacker to potentially escape the sandbox via a crafted HTML page.
- CVE-2026-13934Critical
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-13776Critical
A type confusion vulnerability in the Dawn component of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This issue is rated as Critical in Chromium security.
- CVE-2026-9874Critical
A use-after-free vulnerability in Dawn in Google Chrome prior to 148.0.7778.216 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-79221Medium
Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Severity: Medium)
- CVE-2026-14428High
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-14421Medium
An uninitialized use vulnerability in the Dawn component of Google Chrome on ChromeOS prior to version 150.0.7871.46 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Original NVD description (English source)
Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)