Out of bounds read in Dawn in Google Chrome prior to 149

CVE-2026-11006 is an out-of-bounds read in Dawn, the Chromium-side implementation used for WebGPU work. In plain English: a malicious page can drive Chrome down a bad code path and make it read memory it should not, which can leak data from the affected process or destabilize it. The affected range is Google Chrome prior to 149.0.7827.53; Google’s release notes show the fix landing with 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows and macOS early-stable builds.

There is no authoritative vendor CVSS baseline for this specific CVE yet, so the right way to score it is by chain reality rather than memory-safety fear alone. A browser bug reachable through web content is never ignorable, but an out-of-bounds read is usually a disclosure primitive or crash aid, not a turnkey one-bug compromise. That pushes this below the usual panic tier for Chrome RCEs and sandbox escapes.

Why this verdict

• Started from a medium confidentiality baseline: remote browser OOB-read bugs usually map to memory disclosure or crash behavior, not immediate code execution.
• Downward adjustment for primitive strength: this is a read, not a write or use-after-free, so the stand-alone impact is materially narrower.
• Downward adjustment for attacker workflow: exploitation requires victim browsing / content rendering and therefore is UI:R, which cuts wormability and opportunistic reach.
• Downward adjustment for path specificity: the vulnerable code sits in Dawn/WebGPU, a real but narrower execution path than general-purpose DOM/V8 browsing surfaces.
• Upward adjustment for target ubiquity: Chrome is one of the most common enterprise endpoints, so even a medium-strength primitive can matter at fleet scale.

Why not higher?

I am not taking this to HIGH because the current record does not show direct RCE, sandbox escape, or proven active exploitation. To get from this bug to a materially bad enterprise outcome, the attacker likely needs a second primitive or unusually favorable leakage conditions.

Why not lower?

I am not taking this to LOW because the bug is still remote and web-reachable in a massively deployed client. Browser memory-disclosure primitives are routinely useful for exploit chains, especially against privileged users, developers, and admins with valuable browser-resident material.

1. Force browser update telemetry — Use Chrome enterprise reporting, EDR software inventory, or package management to identify endpoints below 149.0.7827.53. For a MEDIUM verdict there is no noisgate mitigation SLA, so use this in the current operations cycle and complete remediation inside the 365-day window; in practice, browsers should ride your next normal update ring.
2. Disable WebGPU for high-risk cohorts — If patching lags, use Chrome enterprise policy to disable or restrict WebGPU on privileged admins, developers, and externally exposed VDI pools where business impact is acceptable. This is a temporary hardening move, not the fix; for MEDIUM there is no mitigation SLA, so deploy during the current cycle where patch latency exists.
3. Prioritize privileged browsing tiers — Patch or harden admin workstations, jump hosts used for general browsing, and executive endpoints first because the value of leaked browser memory is higher there. There is no noisgate mitigation SLA for MEDIUM, but this prioritization should happen immediately in your next browser ring while the full fleet moves toward the patch.
4. Watch Chrome crash and reset telemetry — Monitor for abnormal increases in Chrome renderer or GPU-process crashes after visits to suspicious sites. This will not prevent exploitation, but it gives you a way to spot targeting while the fleet is being updated inside the 365-day remediation window.

Run this on the target endpoint or through your software-distribution/EDR scripting channel. Invoke with python3 check_chrome_cve_2026_11006.py on macOS/Linux or py check_chrome_cve_2026_11006.py on Windows; standard user rights are usually enough because the script only reads file paths / registry values and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11006.py
# Detect Google Chrome version and compare against fixed version for CVE-2026-11006.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def is_patched(v):
    return v >= FIXED_VERSION


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_windows():
    candidates = []

    # Registry (preferred)
    reg_paths = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in reg_paths:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            candidates.append(("registry", v))

    # Executable paths
    exe_paths = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LOCALAPPDATA', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for path in exe_paths:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                candidates.append((path, v))

    return candidates


def detect_macos():
    candidates = []
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in paths:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                candidates.append((path, v))
    return candidates


def detect_linux():
    candidates = []
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            candidates.append((' '.join(cmd), v))
    return candidates


def main():
    system = platform.system().lower()
    if 'windows' in system:
        candidates = detect_windows()
    elif 'darwin' in system:
        candidates = detect_macos()
    else:
        candidates = detect_linux()

    if not candidates:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    # Choose highest discovered version
    source, version = sorted(candidates, key=lambda x: x[1], reverse=True)[0]

    if is_patched(version):
        print(f'PATCHED: detected {version_to_str(version)} via {source}; fixed threshold is {version_to_str(FIXED_VERSION)}')
        sys.exit(0)
    else:
        print(f'VULNERABLE: detected {version_to_str(version)} via {source}; needs {version_to_str(FIXED_VERSION)} or later')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. NVD - CVE-2026-10927 (Dawn OOB read leading to potential sandbox escape, analogous class)
3. NVD - CVE-2026-9113 (Chrome OOB read with ADP medium scoring, analogous impact model)
4. NVD - CVE-2023-1819 (Chrome OOB read with medium severity, analogous impact model)
5. Chromium issue 41486305 - Dawn/ANGLE undefined behavior leading to OOB reads/writes and type confusion
6. Chromium issue 501187077 - Dawn WebGPU variant bug with public technical detail / PoC-style research
7. FIRST EPSS overview and API reference
8. CISA Known Exploited Vulnerabilities Catalog