Uninitialized Use in Dawn in Google Chrome on Windows prior to 149

CVE-2026-11101 is an uninitialized-use bug in Chrome's Dawn component on Windows, affecting Google Chrome versions prior to 149.0.7827.53. Dawn is Chromium's WebGPU implementation layer, so the practical story is a malicious web page steering a vulnerable browser into exposing data it should keep isolated across origins; the stated impact is cross-origin data leakage, not code execution or persistence.

Google's MEDIUM 6.5 baseline is directionally right, but a little generous once you audit the real attack chain. The attacker is remote and unauthenticated, but still needs a user to browse attacker-controlled content, the flaw is Windows-only, the known impact is confidentiality-only, and there is no KEV entry, no public exploitation claim, and no public PoC in the source set. That keeps this in the operationally important-but-not-fire-drill bucket.

Why this verdict

• Downward pressure: requires UI:R — the attacker must get a user onto malicious content, which sharply reduces reach compared with edge-exposed or zero-click browser bugs.
• Downward pressure: Windows-only — this is not cross-platform Chrome exposure, so a mixed OS fleet immediately sheds part of the vulnerable population.
• Downward pressure: confidentiality-only — the vendor describes cross-origin data leakage, not renderer escape, arbitrary code execution, or persistence.
• Downward pressure: no exploitation evidence — not in KEV, no public Google statement of active abuse, and no public PoC found.
• Upward pressure: Chrome is everywhere — the product is ubiquitous, and browsers sit directly on untrusted content all day, so even a medium-grade info leak deserves clean inventory and normal update discipline.

Why not higher?

This is not an unauthenticated edge-service compromise, and it does not currently present as a reliable path to code execution. The attacker still needs a victim to render malicious content, and the impact described by the vendor stops at cross-origin disclosure rather than system compromise.

Why not lower?

It still hits a massively deployed client application that continuously parses hostile input from the internet. If exploited against the right user at the right time, cross-origin leakage can expose authenticated business data or session material, so writing it off as backlog noise would be too relaxed.

1. Force Chrome relaunch for pending updates — If you already allow Chrome auto-update, the biggest practical gap is users sitting on a vulnerable process that has downloaded but not applied the fix. Use Chrome Enterprise relaunch notification policy to force restart completion; for a MEDIUM verdict there is no mitigation SLA, so this is a hygiene move, not an emergency control.
2. Disable or restrict WebGPU for high-risk cohorts if patch lag exists — Because the flaw sits in Dawn, restricting WebGPU use is a sensible temporary brake for privileged admins, finance users, executives, and unmanaged kiosk-like endpoints if you cannot confirm version uptake. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but use this when operational reality says browser updates lag.
3. Block unmanaged Chrome channels on corporate Windows endpoints — The real exposure is stale browsers outside normal enterprise servicing. Enforce managed Stable or approved Extended Stable via policy and software inventory so straggler user-installed copies do not sit below the fixed build; again, no mitigation SLA applies at MEDIUM, so align this with normal endpoint governance.
4. Monitor for post-browser session abuse — Because the likely payoff is token or page-data theft, watch SaaS sign-ins, token replay, and unusual session reuse from roles with access to sensitive web apps. This does not replace patching, but it helps catch the impact path this CVE actually enables.

Run this on the target Windows endpoint or through your RMM/EDR remote shell. Invoke with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11101.ps1; local admin is not required for standard install paths, but it improves coverage if multiple-user installations exist. The script checks common Chrome executable locations and prints VULNERABLE, PATCHED, or UNKNOWN.

# check-chrome-cve-2026-11101.ps1

# Purpose: Determine likely exposure to CVE-2026-11101 on Windows Chrome installs.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-VersionObject {
    param([string]$v)
    try { return [version]$v } catch { return $null }
}

# Vendor-confirmed fixed build for stable desktop Windows

$FixedStable = Get-VersionObject '149.0.7827.53'
# Extended Stable security build published on 2026-06-03; exact per-CVE backport was not explicitly confirmed in reviewed sources

$ExtendedStableBuild = Get-VersionObject '148.0.7778.254'

$Paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
) | Select-Object -Unique

$Found = @()
foreach ($p in $Paths) {
    if (Test-Path $p) {
        $item = Get-Item $p
        $ver = $item.VersionInfo.ProductVersion
        if (-not $ver) { $ver = $item.VersionInfo.FileVersion }
        $Found += [pscustomobject]@{ Path = $p; Version = $ver; VersionObj = (Get-VersionObject $ver) }
    }
}

if ($Found.Count -eq 0) {
    Write-Output 'UNKNOWN: Chrome executable not found in common install paths.'
    exit 2
}

$AnyVuln = $false
$AnyPatched = $false
$AnyUnknown = $false

foreach ($f in $Found) {
    if (-not $f.VersionObj) {
        Write-Output ("UNKNOWN: Could not parse version at {0} ({1})" -f $f.Path, $f.Version)
        $AnyUnknown = $true
        continue
    }

    if ($f.VersionObj -ge $FixedStable) {
        Write-Output ("PATCHED: {0} -> {1} (>= 149.0.7827.53)" -f $f.Path, $f.Version)
        $AnyPatched = $true
        continue
    }

    # Handle the published Extended Stable servicing build conservatively.

    if ($f.VersionObj.Major -eq 148 -and $f.VersionObj -ge $ExtendedStableBuild) {
        Write-Output ("UNKNOWN: {0} -> {1} is an Extended Stable-era build; confirm channel policy/backport status in management records." -f $f.Path, $f.Version)
        $AnyUnknown = $true
        continue
    }

    Write-Output ("VULNERABLE: {0} -> {1} (< 149.0.7827.53 and not a confirmed patched Extended Stable build)" -f $f.Path, $f.Version)
    $AnyVuln = $true
}

if ($AnyVuln) { exit 1 }
if ($AnyUnknown -and -not $AnyPatched) { exit 2 }
if ($AnyUnknown -and $AnyPatched) {
    Write-Output 'UNKNOWN: Mixed state detected; at least one install is patched, but another could not be fully classified.'
    exit 2
}

Write-Output 'PATCHED'
exit 0

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. Chrome 149 Release Notes
3. Government of Canada Cyber Centre Advisory AV26-544
4. CIRCL Vulnerability-Lookup entry for CVE-2026-11101
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS Overview
7. Chrome Enterprise - Release Channels
8. Chrome Enterprise - Manage Chrome Updates