Inappropriate implementation in Dawn in Google Chrome prior to 149

CVE-2026-11091 is an *inappropriate implementation* flaw in Chrome’s Dawn component, the WebGPU implementation behind navigator.gpu. A malicious site can drive vulnerable code paths with crafted HTML/JavaScript and potentially reach out-of-bounds behavior. Affected builds are Chrome before 149.0.7827.53; Google’s June 2, 2026 stable rollout lists 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and macOS as fixed, with Android inheriting the same desktop security fixes in 149.0.7827.59.

The supplied 8.8/HIGH CVSS reads like a generic browser memory-bug worst case, but reality is narrower. Google’s own Chrome release notes classified this CVE as Medium, there is no KEV listing, the provided EPSS is 0.00035, no public exploit chain was found, and meaningful impact still depends on user navigation plus reliable WebGPU/Dawn exploitation inside Chrome’s sandboxed multi-process model. For an enterprise patch queue, that is not nonsense risk, but it is also not front-of-line over server-side RCE or actively exploited browser zero-days.

Why this verdict

• Vendor baseline adjusted down: Google’s own Chrome release notes label this CVE Medium, which is more credible for Chrome internals than a generic external CVSS label.
• User interaction required: the attacker needs a victim to visit hostile content, which means phishing, malvertising, or content injection has to work first.
• Feature-path narrowing: exploitation depends on reaching Dawn/WebGPU, not just any browser tab. WebGPU availability varies by platform, policy, blocklist state, and hardware/driver path.
• Blast radius is endpoint-local: even if triggered, this lands inside Chrome’s sandboxed browser architecture and usually needs chaining for durable host compromise or lateral enterprise impact.
• Threat intel is cold: no KEV listing, no public PoC found, and the supplied EPSS 0.00035 argues against near-term mass exploitation pressure.

Why not higher?

If this were actively exploited, had a public reliable PoC, or were a proven sandbox escape, the score would rise fast. Likewise, a WebGPU/Dawn bug with demonstrated code execution across current Chrome builds would deserve a HIGH or CRITICAL patch slot; this record does not show that.

Why not lower?

It is still a remotely reachable client-side Chrome bug in a massive deployment surface, and browsers are attacker-favorite initial-access targets. Even without exploitation evidence, drive-by exposure plus potential out-of-bounds behavior is too much risk to wave away as LOW or IGNORE.

1. Enforce Chrome auto-update and relaunch compliance — Make sure managed Chrome endpoints actually cross the fixed build line and are not sitting on pending restarts. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers should be cleaned up far earlier through normal enterprise update enforcement.
2. Disable WebGPU for exception groups — For high-risk users, kiosks, unmanaged VDI pools, or systems that cannot move off vulnerable builds cleanly, use Chrome enterprise policy or platform controls to turn off WebGPU/Dawn exposure. There is no mitigation SLA for this severity bucket, so use it as a targeted temporary control while you close remaining vulnerable endpoints inside the remediation window.
3. Route risky browsing through isolation or stronger URL filtering — Browser isolation, SWG category blocking, and malvertising suppression reduce the odds that users ever hit the crafted page needed to trigger the bug. With a MEDIUM reassessment, treat this as risk reduction for exposed populations rather than an emergency all-hands mitigation.
4. Watch for browser crash clusters — Repeated GPU-process or renderer crashes on the same cohort can be your only early clue of exploit development or noisy probing. Add a short-term detection lens for abnormal Chrome crash spikes while your patch telemetry catches up.

Run this on the target endpoint or in your endpoint management tool as a local script. Invoke with python3 check_chrome_cve_2026_11091.py on macOS/Linux or py check_chrome_cve_2026_11091.py on Windows; no admin rights are normally required, though Windows registry reads may work best in a standard user session with access to installed-app keys.

#!/usr/bin/env python3
# check_chrome_cve_2026_11091.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True)
        return out.strip()
    except Exception:
        return None


def windows_version():
    candidates = []
    try:
        import winreg
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r"Software\Google\Chrome\BLBeacon", "version"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\Google\Chrome\BLBeacon", "version"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\WOW6432Node\Google\Chrome\BLBeacon", "version"),
        ]
        for hive, path, name in reg_paths:
            try:
                key = winreg.OpenKey(hive, path)
                val, _ = winreg.QueryValueEx(key, name)
                candidates.append(str(val))
            except Exception:
                pass
    except Exception:
        pass

    exe_paths = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for p in exe_paths:
        if p and os.path.exists(p):
            out = run_cmd([p, "--version"])
            if out:
                candidates.append(out)

    for c in candidates:
        v = parse_version(c)
        if v:
            return v, c
    return None, None


def unix_version():
    commands = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium", "--version"],
        ["chromium-browser", "--version"],
        ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome", "--version"],
    ]
    for cmd in commands:
        exe = cmd[0]
        if os.path.isabs(exe) or shutil.which(exe):
            out = run_cmd(cmd)
            if out:
                v = parse_version(out)
                if v:
                    return v, out
    return None, None


def main():
    system = platform.system().lower()
    if "windows" in system:
        version, raw = windows_version()
    else:
        version, raw = unix_version()

    if not version:
        print("UNKNOWN - Chrome version not found")
        sys.exit(2)

    if cmp_ver(version, FIXED) < 0:
        print(f"VULNERABLE - detected version {'.'.join(map(str, version))} < 149.0.7827.53")
        sys.exit(1)
    else:
        print(f"PATCHED - detected version {'.'.join(map(str, version))} >= 149.0.7827.53")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases - June 2026 archive
3. Chromium - WebGPU Technical Report
4. Chrome for Developers - WebGPU troubleshooting tips
5. Chrome for Developers - WebGPU overview
6. Chromium Docs - Chrome Security Update FAQ
7. CISA - Known Exploited Vulnerabilities Catalog
8. FIRST - EPSS API documentation