External risk intelligence

Chrome WebGPU Use-After-Free Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121089

The vulnerability exists in the WebGPU implementation of a widely used web browser. As a client-side component, it is triggered by navigating to a crafted HTML page, making it highly accessible to remote attackers who can host malicious web content that is reachable by any user on the public internet.

Use After Free

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in Google Chrome's WebGPU functionality that could allow a malicious website to execute code on a user's device. This vulnerability, classified as critical, could potentially enable an attacker to bypass security protections and gain unauthorized access.

Flaw in browser's graphics code could be exploited.
Critical vulnerability affecting widely used browser.
Confirming relevance and exposure is the main concern.

Attack Path

How an attacker could exploit the issue

A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious webpage. This webpage contains specially crafted HTML that targets a flaw in the WebGPU component of Google Chrome. Successful exploitation could allow the attacker to execute code beyond the browser's normal security boundaries.

Entry condition: Remote access to a user.
Trigger point: Visiting a crafted HTML page.
Resulting risk: Potential arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the WebGPU component of Google Chrome could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a malicious HTML page. This could affect the confidentiality, integrity, and availability of the user's system and data.

System code execution outside sandbox.
User visits malicious HTML page.
Potential for arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's WebGPU implementation requires immediate attention from teams managing end-user workstations and web-facing applications. The initial focus should be on identifying all Chrome instances, assessing their exposure, and determining business criticality. Coordinating with application owners and potentially vendor management will be crucial for planning remediation, likely involving a controlled rollout of the update during a maintenance window.

Own by Endpoint & Web Application Teams.
Verify Chrome instances and exposure.
Plan controlled update rollout.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's WebGPU component?

WebGPU is a modern web standard built into Google Chrome that provides high-performance access to a computer's graphics processing unit (GPU). It allows web applications to run complex 3D graphics and compute tasks directly within the browser, effectively turning the browser into a powerful platform for gaming, machine learning, and advanced visual tools.

How does CVE-2026-121089 cause a security weakness?

This vulnerability is a 'Use After Free' (CWE-416) error. In plain terms, the browser's memory management system accidentally attempts to access a piece of data after it has already been cleared or deleted. A specially crafted website can exploit this mistake to manipulate memory and potentially run unauthorized code on the host machine.

Does just opening the browser trigger this flaw?

No, simply having the browser open is not enough to trigger the vulnerability. The attack requires a user to actively navigate to a malicious website containing the specific, crafted HTML that exploits the flawed WebGPU memory handling. Browsing safe, trusted websites does not trigger this issue.

Is my machine at risk if Chrome is only used for internal tools?

According to Halo Surface Signal, this risk is highly relevant because the vulnerability is triggered by common web browsing. Since attackers can host malicious content anywhere on the public internet, any system using an affected version of Chrome to access the web—even if primarily for internal tasks—is potentially reachable and at risk.

How should I respond to this Chrome update?

The primary response is to update your browser software to the version specified by the vendor. Since this involves a critical component of the browser, prioritize rolling out the stable channel update to all workstations. Focus on ensuring that endpoint users receive the patch as quickly as possible to close the memory management gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.