CVE-2026-10968: Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Dawn graphics component of Google Chrome on Windows, affecting versions prior to 149.0.7827.53. It is reachable over the network and requires no authentication, but does require a victim to interact with a crafted HTML page; additionally, the attacker must have already compromised the renderer process. Successful exploitation allows the attacker to leak cross-origin data, meaning they can read data from web origins other than the one the victim is browsing. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the affected service must be reachable from the internet or an accessible network segment.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user who visits the crafted page can trigger the vulnerability, provided the renderer has already been compromised.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering-dependent attack that requires the user to take an action.

• Attack complexityDetail

  The CVSS vector assigns low attack complexity for the input-validation step itself, though the overall attack chain carries a separate prerequisite of renderer compromise, which is not reflected in this token.

Blast Radius

• The attacker reads data belonging to web origins other than the one the victim is currently visiting, including cookies, tokens, or page content scoped to those origins.
• Cross-origin data leakage can expose authenticated session material or sensitive page content from third-party sites loaded in the same browser session.
• There is no integrity or availability impact: the attacker cannot modify data or crash the browser through this vulnerability alone.