CVE-2026-11091: Inappropriate implementation in Dawn in Google Chrome prior to 149

Synopsis

An out-of-bounds memory access vulnerability exists in Dawn, the WebGPU graphics backend used by Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a victim to visit or be redirected to a crafted HTML page. Successful exploitation gives an attacker read and write access to process memory as well as the ability to crash the browser, enabling data theft, content tampering, or remote code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable through normal browser web traffic.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making social engineering or a malicious ad/link the necessary delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads process memory contents, which may include session tokens, credentials, or locally cached user data rendered by the browser.
• Writes to out-of-bounds memory regions, enabling modification of browser state or injected code execution within the Chrome renderer process.
• Crashes the affected Chrome process, causing loss of the current browsing session and any unsaved in-page state.
• Combined high confidentiality, integrity, and availability impact means a successful exploit can chain memory reads and writes into full renderer compromise.