Out of bounds read in Dawn in Google Chrome prior to 149

CVE-2026-10927 is an out-of-bounds read in Chrome's Dawn component, the graphics layer behind WebGPU, fixed in Chrome 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and macOS. The key catch is in Google's own description: the attacker must have already compromised the renderer process before this bug becomes useful, which makes it a post-compromise browser-chain primitive rather than a clean one-shot drive-by.

Google rated it HIGH (8.3), which is fair if you score pure technical impact inside a browser exploit chain. For enterprise patch triage, though, that overstates the standalone risk: this bug requires a prior browser exploit stage, lives behind Chrome's sandbox and Site Isolation design, has no KEV listing, very low EPSS, and no public in-the-wild exploitation evidence located. That combination pushes it down to MEDIUM for most fleets.

Why this verdict

• Renderer compromise required: this is not a clean remote entry point; it assumes the attacker already beat Chrome once, which is major downward pressure on urgency.
• Client-side, UI-driven exposure: the reachable population is every browser endpoint in theory, but exploitation still depends on users rendering hostile content and the attacker having a working first-stage renderer exploit.
• Low threat telemetry: no KEV listing, no located public PoC, and a very low EPSS all argue against broad opportunistic exploitation right now.

Why not higher?

If this were a standalone remote code execution bug or an immediately weaponizable sandbox escape with public exploitation evidence, it would stay in HIGH or higher. But the chain starts with 'attacker already owns the renderer', which means this CVE is mostly useful to advanced operators already carrying a separate browser exploit stage.

Why not lower?

This still sits inside Chrome, one of the most widely deployed enterprise applications on the planet, and browser exploit chains remain strategically valuable. Even a read primitive can matter for mitigation bypass, secret leakage, or stabilizing a follow-on escape, so writing it off as backlog-only would be too casual.

1. Force evergreen browser updates — Make sure Chrome auto-update is enforced and that stragglers are surfaced in fleet management. For a MEDIUM verdict there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but for browsers you should still close version drift quickly because chained browser bugs age badly.
2. Tighten WebGPU and risky browser features where not needed — If business workflows do not require WebGPU or advanced graphics features, restrict them through enterprise policy for high-risk user groups and unmanaged browsing tiers. There is no mitigation SLA for MEDIUM here; treat this as hardening that reduces exploit-chain surface while you remediate within the 365-day window.
3. Protect high-risk users with browser isolation or stronger web filtering — Executives, admins, developers, and helpdesk operators are the people worth spending a two-stage browser chain on. Apply stronger link isolation, category filtering, or remote browser isolation to those cohorts to make stage-one delivery and renderer compromise materially harder.
4. Monitor for stale Chrome populations — Inventory endpoints that missed the Chrome 149 rollout and treat them as hygiene debt. MEDIUM means no mitigation SLA, but it does not mean you should tolerate unknown browser versions across a 10,000-host fleet.

Run this on the target endpoint or through your software inventory/EDR remote execution layer. Save as check_cve_2026_10927.py and invoke with python3 check_cve_2026_10927.py on macOS/Linux or py check_cve_2026_10927.py on Windows; no admin rights are required if the browser is installed in standard locations.

#!/usr/bin/env python3
# Check Chrome/Chromium version against CVE-2026-10927 fixed builds
# Outputs exactly one of: VULNERABLE, PATCHED, UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_ge(a, b):
    return a >= b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidates_windows():
    paths = []
    envs = [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData'),
    ]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe',
    ]
    for base in envs:
        if not base:
            continue
        for suf in suffixes:
            p = Path(base) / Path(suf)
            paths.append(str(p))
    return paths


def candidates_macos():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]


def candidates_linux():
    return [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium',
        '/opt/google/chrome/chrome',
    ]


def detect_version():
    system = platform.system().lower()
    paths = []

    if 'windows' in system:
        paths = candidates_windows()
    elif 'darwin' in system:
        paths = candidates_macos()
    else:
        paths = candidates_linux()

    for path in paths:
        if Path(path).exists():
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return path, ver, out

    # Fallback to PATH resolution
    for cmd in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        out = run_cmd([cmd, '--version'])
        ver = parse_version(out)
        if ver:
            return cmd, ver, out

    return None, None, None


def main():
    path, ver, raw = detect_version()
    if not ver:
        print('UNKNOWN')
        sys.exit(2)

    if version_ge(ver, FIXED):
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 500090141
3. Chromium Security homepage
4. Chromium Docs - Threat Model and Defenses Against Compromised Renderers
5. Chromium Site Isolation
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation