CVE-2026-11015: Out of bounds read in WebGPU in Google Chrome prior to 149

Synopsis

An out-of-bounds read vulnerability exists in the WebGPU component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but a victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation allows an attacker to read arbitrary memory regions from the browser process, disclosing sensitive in-memory data and potentially crashing the affected tab or renderer process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page to a victim browser, so the Chrome instance must be reachable to normal web traffic.

• AuthenticationNot required

  No account, session token, or prior credential is needed; any anonymous network request to the victim browser is sufficient.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making social engineering or a malicious ad/link the delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites beyond the victim loading the page.

Blast Radius

• An attacker reads arbitrary memory from the Chrome renderer process, which may include cached credentials, session cookies, and page content from other open tabs sharing the same process.
• The out-of-bounds read can trigger an unhandled exception that crashes the affected renderer, terminating the victim's active browser tab or the entire browser process depending on Chrome's process isolation posture.
• If the browser embeds sensitive application tokens or OAuth bearer tokens in memory at the time of exploitation, those values are directly exposed to the attacker without any further privilege escalation.