CVE-2026-9874 is a critical use after free in Dawn, the component behind Chrome's WebGPU support, rated 9.6. A crafted HTML page could potentially lead to a sandbox escape. Chrome 148.0.7778.216 or later on Windows and Mac fixes it, and Linux has its own build number.
What's affected
- Product: Google Chrome on Windows, macOS and Linux.
- Affected: versions before the May 2026 Stable channel update to 148.
- Fixed: the release notes list 148.0.7778.216 and 217 for Windows, 148.0.7778.215 and 216 for Mac, and 148.0.7778.215 for Linux. The CVE record says before 148.0.7778.216, so use the numbers for your platform from the release notes.
- Severity: Chromium rates it Critical. The same update contains 151 security fixes.
- Other browsers: Chromium based browsers take the fix on their own schedule, so check each vendor.
How to check if you're exposed
Open chrome://version in the browser and read the version string. On managed fleets, use your endpoint tool to list Chrome versions:
google-chrome --version
On Windows and macOS the About Chrome page under Settings triggers an update check and shows the current version. A pending restart still leaves the old version running, so confirm the version after relaunching.
What to do now
- Update Chrome to the fixed version for your platform, then relaunch the browser.
- For managed devices, push the update through your management tool and report on devices still behind.
- Update other Chromium based browsers and embedded runtimes, such as Electron apps, when their vendors release a fix.
- Keep automatic updates on, and avoid delaying the restart on high risk machines.
- Add Chrome and Chromium versions to your software inventory so the next update is easy to measure.
Why it matters
The record lists CWE-416, use after free. Dawn is the layer that handles WebGPU work for the browser. A use after free means code uses memory after it has been released, and an attacker who can control what ends up there may change program behavior. The release notes label the bug Critical, and the record says it could allow a sandbox escape from a crafted HTML page.
The vector needs a user to visit a page and shows a changed scope, since the browser sandbox is meant to contain a bug of this kind. The record does not mark this CVE as exploited in the wild, and the Chrome release notes do not say it is. Chrome often restricts bug details until most users have updated, so there is little public technical detail.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to restart Chrome after updating?
Yes. The new version only runs after the browser relaunches, so check chrome://version afterward.
Sources
Last reviewed: 19 October 2026.
