Researchers Found 3 Hidden Bugs in Chrome's New WebGPU Tech

WebGPU is a new feature arriving in browsers that lets websites tap directly into your computer's graphics chip. That means smoother 3D games, faster map rendering, and on-device AI that runs without sending your data to a server. It's powerful, but it's also brand new, and new plumbing in a browser is exactly where security problems like to hide.

Testing something like WebGPU is genuinely hard. The official test suite only checks that browsers behave correctly when used properly — not what happens when a website misbehaves. And random "throw garbage at it" testing tools (called fuzzers) get confused by WebGPU's complexity. So a research team built LANTERN, a tool that reads the written WebGPU rulebook, pulls out the rules about what order commands must happen in and how long objects should live, then automatically rewrites existing tests to break those rules on purpose. It generates good tests and deliberately bad ones.

They ran thousands of these tests against Chromium, the open-source engine inside Chrome and Edge, with extra memory-checking turned on. LANTERN found three bugs that could be reproduced reliably in the Chromium versions current at the time, including one heap corruption — a memory error where a program writes where it shouldn't. That class of bug is the kind security researchers care about most, because it can sometimes be twisted into letting an attacker run code on your machine.

What this means for you: browsers are becoming as capable as installed apps, which is convenient but also expands what an attacker could target. The reassuring part is that automated, rule-aware testing is getting good enough to catch these flaws before they reach you. One honest caveat: this is a research paper. There's no evidence anyone was attacked using these bugs, and the findings were shared so browser makers can patch them.