CVE-2026-10973: Uninitialized Use in Dawn in Google Chrome prior to 149

Synopsis

An uninitialized-use vulnerability in Dawn, the WebGPU backend in Google Chrome, allows a remote attacker to leak cross-origin data. The attack is reachable over the network, requires no authentication, but does require the victim to visit or interact with a crafted HTML page. Successful exploitation reads data from origins the attacker should not have access to, such as session tokens or page content from other tabs or iframes. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account, session, or credential on the target system is needed to deliver the exploit.

• Victim interactionRequired

  The victim must navigate to or otherwise load the attacker-controlled HTML page, making this a social-engineering vector requiring a click, redirect, or embedded resource load.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other environmental factors.

Blast Radius

• The attacker reads data belonging to other web origins, including page content, DOM state, or HTTP responses that the browser's same-origin policy should have blocked.
• Cross-origin session tokens or authentication cookies accessible to the renderer process can be read and exfiltrated.
• Sensitive data rendered in other tabs, iframes, or background service workers within the same browser profile is exposed to the attacker.