Uninitialized Use in Dawn WebGPU Engine in Chrome on Windows Leaks Cross-Origin Data

CVE-2026-11101 is an uninitialized-use flaw in Dawn, Google Chrome's open-source implementation of the WebGPU standard, affecting Chrome on Windows prior to version 149.0.7827.53 (stable channel update June 4, 2026). When Chrome allocates GPU memory for WebGPU shader operations, certain buffers are not zeroed before reuse. A remote attacker who convinces a victim to visit a crafted HTML page can issue timed WebGPU calls that read stale GPU memory belonging to a different origin, leaking cross-origin data such as rendered page content, partial DOM state, or cached texture data. The impact is confidentiality-only — there is no integrity or availability impact, and no path to code execution from this bug alone.

Google rates this Medium (6.5) via Chromium's own severity guidelines, and that label is directionally correct. The CVSS vector assigns C:H (high confidentiality impact) because cross-origin data can include session tokens or rendered banking pages, but I:N/A:N keeps the ceiling low. In practice, Chrome's aggressive auto-update pipeline means the vulnerable population shrinks rapidly after disclosure. The 6.5 base score slightly overstates the real-world risk for managed enterprise fleets where Chrome is centrally updated, but it is reasonable for unmanaged consumer endpoints. noisgate adjusts downward to 5.5 based on the absence of exploitation, no public PoC, and the auto-update factor.

Sources.

1. CVE-2026-11101 — CyberStrike Detail
2. CVE-2026-11101 — OpenCVE
3. Chrome 149 Patches 429 Vulnerabilities — SecurityWeek
4. Chrome 149 Security Update — Cyber Security News
5. CVE-2026-11101 — CVE.org Official Record
6. Chromium Bug Tracker — Issue 500443031
7. CVE-2026-7983 Dawn Cross-Origin Leak Analysis — Windows News
8. Chrome 149 Update Resolves 18 Severe Vulnerabilities — SecurityWeek

Run this script on each Windows target host where Chrome is installed. No elevated privileges required — it reads the Chrome executable version from the file system. Example invocation: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-11101.ps1

# Check-CVE-2026-11101.ps1
# Checks if Google Chrome on Windows is vulnerable to CVE-2026-11101
# (Uninitialized Use in Dawn, cross-origin data leak)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$fixedVersion = [version]"149.0.7827.53"
$chromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

$found = $false
foreach ($path in $chromePaths) {
    if (Test-Path $path) {
        $found = $true
        try {
            $fileVersion = (Get-Item $path).VersionInfo.ProductVersion
            $currentVersion = [version]$fileVersion
            Write-Host "Chrome found at: $path"
            Write-Host "Installed version: $fileVersion"
            Write-Host "Fixed version: $fixedVersion"
            if ($currentVersion -lt $fixedVersion) {
                Write-Host "VULNERABLE - Chrome $fileVersion is below fixed version $fixedVersion" -ForegroundColor Red
                exit 1
            } else {
                Write-Host "PATCHED - Chrome $fileVersion is at or above fixed version $fixedVersion" -ForegroundColor Green
                exit 0
            }
        } catch {
            Write-Host "UNKNOWN - Could not parse version from $path : $_" -ForegroundColor Yellow
            exit 2
        }
    }
}

if (-not $found) {
    Write-Host "UNKNOWN - Google Chrome not found in standard installation paths" -ForegroundColor Yellow
    exit 2
}