Uninitialized Use in Dawn in Google Chrome prior to 149

CVE-2026-10976 is an *uninitialized use* bug in Chrome's Dawn component, Chromium's WebGPU implementation. In affected Chrome builds prior to 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS, a malicious site can use crafted HTML to trigger disclosure of potentially sensitive data from browser process memory. The technical impact is *confidentiality only*: memory disclosure, not direct code execution, persistence, or sandbox escape.

Google's HIGH 7.4 vendor rating is understandable from a browser-at-scale perspective, but it lands high for most enterprise patch queues once you do the friction audit. The chain still needs a user to render attacker content, the practical payoff is memory leakage rather than code exec, Chrome's sandbox and Site Isolation limit blast radius, and there is no KEV entry, no known in-the-wild exploitation, and extremely low EPSS. For a 10,000-host fleet, this belongs in the normal browser-update lane, not the incident lane.

Why this verdict

• Down one full notch for impact reality: vendor CVSS treats confidentiality loss as high, but this is still *info leak only* — no direct code execution, no sandbox escape, no integrity or availability loss.
• Down for attacker workflow friction: exploitation requires the victim to *load attacker-controlled web content*, which implies phishing, malvertising, SEO poisoning, or site compromise rather than direct network reachability.
• Down for exploit reliability and reachability: the vulnerable path sits in Dawn/WebGPU, which is materially narrower than 'any HTML parser bug' because runtime feature/platform conditions matter in real fleets.
• Down for threat intel: not in KEV, no public in-the-wild use found, and EPSS 0.035% / 11th percentile is weak pressure compared with what usually deserves a fleetwide fast lane.
• Not lower because population matters: Chrome is everywhere, exploitation is remote with no authentication, and session or content leakage from a user browser can still produce meaningful downstream abuse.

Why not higher?

This stops short of HIGH because the attack does not hand over code execution or host compromise by itself. The chain needs user interaction, the exploit output is memory disclosure rather than takeover, and current threat intelligence does not show KEV listing, public weaponization, or active campaigns.

Why not lower?

This is still a remotely triggerable browser bug in one of the most widely deployed client applications in the enterprise. Even confidentiality-only browser flaws can leak tokens, page data, or user secrets, so it is more than backlog trivia.

1. Force browser auto-update compliance — Validate that Chrome stable channels are actually converging to 149.0.7827.53+ through your management plane. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the remediation window, but browser drift should still be corrected in the next normal enterprise update cycle.
2. Disable WebGPU for high-risk user groups — If you have admins, finance, developers with production access, or users in hostile browsing roles, disable or restrict WebGPU/Dawn through enterprise policy as a temporary blast-radius reducer until patched. For MEDIUM, there is no mitigation SLA, so use this selectively where the user risk justifies the operational tradeoff.
3. Route risky browsing through isolation or filtering — Apply browser isolation, secure web gateway controls, Safe Browsing enforcement, or stricter category filtering to reduce the chance of victims ever rendering attacker pages. This is a sensible compensating control for exposed user populations, but under a MEDIUM rating there is no mitigation SLA driving emergency rollout.
4. Hunt for stale Chrome installs — Inventory unmanaged laptops, VDI gold images, packaged offline installers, and developer test channels that often miss mainstream browser updates. The operational goal is to eliminate long-tail vulnerable browsers before they sit unpatched inside the 365-day remediation window.

Run this on the target endpoint or through your fleet agent, not from an auditor workstation. Invoke it with python3 check_chrome_cve_2026_10976.py on Windows, macOS, or Linux; it needs only standard user rights because it reads installed application metadata and common install paths. It outputs exactly one of VULNERABLE, PATCHED, or UNKNOWN and exits with 1, 0, or 2 respectively.

#!/usr/bin/env python3
# check_chrome_cve_2026_10976.py
# Detects whether installed Google Chrome is below the fixed version for CVE-2026-10976.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_windows():
    commands = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in commands:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver

    candidates = [
        Path(os.environ.get("ProgramFiles", r"C:\Program Files")) / "Google/Chrome/Application/chrome.exe",
        Path(os.environ.get("ProgramFiles(x86)", r"C:\Program Files (x86)")) / "Google/Chrome/Application/chrome.exe",
        Path(os.environ.get("LOCALAPPDATA", "")) / "Google/Chrome/Application/chrome.exe",
    ]
    for exe in candidates:
        if exe.is_file():
            out = run_cmd([str(exe), "--version"])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def get_version_macos():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        str(Path.home() / "Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for exe in candidates:
        if os.path.isfile(exe):
            out = run_cmd([exe, "--version"])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def get_version_linux():
    names = ["google-chrome", "google-chrome-stable", "chrome", "chromium", "chromium-browser"]
    for name in names:
        exe = shutil.which(name)
        if exe:
            out = run_cmd([exe, "--version"])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def main():
    system = platform.system().lower()
    if "windows" in system:
        ver = get_version_windows()
    elif "darwin" in system:
        ver = get_version_macos()
    elif "linux" in system:
        ver = get_version_linux()
    else:
        print("UNKNOWN")
        sys.exit(2)

    if not ver:
        print("UNKNOWN")
        sys.exit(2)

    if ver < FIXED_VERSION:
        print("VULNERABLE")
        sys.exit(1)
    else:
        print("PATCHED")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. GitHub Advisory Database - GHSA-mx4h-4m2f-fwrr
2. Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
3. Chromium Security
4. Chromium Site Isolation
5. Chrome for Developers - WebGPU overview
6. Chrome for Developers - WebGPU troubleshooting
7. CISA Known Exploited Vulnerabilities Catalog
8. CWE-457: Use of Uninitialized Variable