CVE-2026-11665: Google Chrome Information Disclosure Flaw

CVE-2026-11665 Overview

CVE-2026-11665 is an out-of-bounds read vulnerability in the Dawn component of Google Chrome on Windows. Dawn is Chrome's WebGPU implementation, providing cross-platform access to GPU functionality from web content. A remote attacker can exploit this flaw by serving a crafted HTML page that triggers the out-of-bounds read, leaking cross-origin data from the renderer process. The vulnerability requires user interaction, specifically visiting a malicious or compromised page. Google has rated the Chromium security severity as High, while the assigned CVSS 3.1 score is 4.3. Versions of Google Chrome on Windows prior to 149.0.7827.103 are affected.

Critical Impact
Attackers can leak cross-origin data through a crafted HTML page, undermining the same-origin policy that isolates web content between sites.

Affected Products

Google Chrome on Windows prior to 149.0.7827.103
Dawn (WebGPU) component within Chromium
Downstream Chromium-based browsers on Windows shipping pre-149 Dawn code

Discovery Timeline

2026-06-09 - CVE-2026-11665 published to NVD
2026-06-09 - Last updated in NVD database
Google released the fix in Chrome Stable channel update 149.0.7827.103, documented in the Google Chrome Stable Update announcement

Technical Details for CVE-2026-11665

Vulnerability Analysis

The flaw is an out-of-bounds read [CWE-125] inside Dawn, the native implementation of the WebGPU API used by Chrome. WebGPU exposes GPU resource creation, command encoding, and shader execution to JavaScript running in the browser. When Dawn processes specific GPU commands or resource descriptors, it reads memory beyond the bounds of an intended buffer. The disclosed memory can contain data from other origins handled by the same renderer process, breaking cross-origin isolation. Successful exploitation does not require authentication, but the user must load attacker-controlled HTML in the affected browser.

Root Cause

The root cause is missing or insufficient bounds validation in a Dawn code path that handles attacker-influenced sizes, offsets, or indices. When the input drives a read past an allocation boundary, adjacent process memory becomes accessible to the calling context. Because the renderer process handles content from multiple origins through shared GPU state, the leaked bytes can include cross-origin response data, tokens, or texture contents.

Attack Vector

The attack vector is network-based and user-interaction dependent. An attacker hosts a page that loads a crafted WebGPU workload through JavaScript and shaders. When a victim visits the page, the page issues GPU calls that trigger the out-of-bounds read in Dawn and exfiltrates the leaked bytes back to attacker infrastructure. No sandbox escape is required to read in-process memory, but the leak is confined to information disclosure rather than direct code execution. Additional technical context is available in the Chromium Issue Tracker Entry.

// No verified proof-of-concept code has been published for CVE-2026-11665.
// The vulnerability is triggered by a crafted HTML page invoking WebGPU
// (Dawn) APIs that cause an out-of-bounds read of renderer memory.

Detection Methods for CVE-2026-11665

Indicators of Compromise

Chrome client versions on Windows reporting a User-Agent build prior to 149.0.7827.103
Outbound connections from browser processes to unfamiliar domains immediately after WebGPU-heavy page loads
Pages requesting navigator.gpu access from low-reputation or newly registered domains

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build below 149.0.7827.103.
Inspect web proxy and DNS logs for sessions where renderer processes contact unknown hosts after invoking WebGPU APIs.
Correlate browser crash telemetry tied to the Dawn module, which can indicate exploitation attempts that misalign memory.

Monitoring Recommendations

Continuously track Chrome version drift through endpoint management tooling and alert on stale installations.
Monitor chrome.exe child process and network behavior for anomalous data egress following script-heavy page visits.
Enable browser security telemetry forwarding to a centralized data lake to retain forensic evidence of suspicious renderer activity.

How to Mitigate CVE-2026-11665

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 149.0.7827.103 or later.
Force-restart Chrome after deployment so the patched Dawn binary loads into memory.
Audit Chromium-based browsers and embedded WebViews on Windows for pre-149 Dawn code and patch accordingly.

Patch Information

Google fixed CVE-2026-11665 in the Chrome Stable channel release 149.0.7827.103 for Windows. Administrators should deploy this build through Group Policy, Chrome Browser Cloud Management, or their endpoint management platform. Release details are in the Google Chrome Stable Update advisory, and the underlying bug is tracked in the Chromium Issue Tracker Entry.

Workarounds

Disable WebGPU temporarily by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled on affected endpoints until patching completes.
Block access to untrusted sites that require WebGPU via web proxy or DNS filtering policies.
Enforce Chrome auto-update policies through Group Policy to prevent users from staying on outdated builds.

bash

# Enforce Chrome update policy on Windows via registry
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f

# Verify installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion