Is CVE-2026-11676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11676 being exploited in the wild.

How severe is CVE-2026-11676?

Informational severity, published 9 June 2026.

Which products and versions are affected?

Google Chrome prior to 149.0.7827.103; Google ChromeOS prior to 149.0.7827.103.

Is there a fix for CVE-2026-11676?

A patch was published on 2026-06-08: Fixed in Stable Channel Update 149.0.7827.102/.103 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11676 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-11676?

Check whether you run Google Chrome or Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11676: Google Chrome improper input validation in Dawn

CVE-2026-11676 · Severity: info · Published 2026-06-09

Google Chrome is a widely used web browser. A security vulnerability in its Dawn component (the engine responsible for WebGPU graphics) could allow a malicious website to break out of the browser's security sandbox. If successful, an attacker who has already compromised the browser's rendering process could gain broader access to the underlying Linux or ChromeOS system, potentially leading to unauthorized data access or full system compromise.

Technologies: Google Chrome, Google ChromeOS. Vendors: Google.

Quick answers

Is CVE-2026-11676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11676 being exploited in the wild.
How severe is CVE-2026-11676?: Informational severity, published 9 June 2026.
Which products and versions are affected?: Google Chrome prior to 149.0.7827.103; Google ChromeOS prior to 149.0.7827.103.
Is there a fix for CVE-2026-11676?: A patch was published on 2026-06-08: Fixed in Stable Channel Update 149.0.7827.102/.103 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11676 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-11676?: Check whether you run Google Chrome or Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability (CWE-20) exists in the Dawn component of Google Chrome for Linux and ChromeOS. Dawn is the implementation of the WebGPU standard in Chromium. The vulnerability is reachable by a remote attacker who can entice a user to visit a specially crafted HTML page. A successful exploit requires the attacker to have already achieved code execution within the sandboxed renderer process; from there, the insufficient validation in Dawn allows for a sandbox escape to the browser process or host operating system. Google has addressed this in version 149.0.7827.103.

Affected products

Google Chrome prior to 149.0.7827.103
Google ChromeOS prior to 149.0.7827.103

Timeline

2026-05-27: disclosed: Reported to Chrome by Google researchers
2026-06-08: patched: Fixed in Stable Channel Update 149.0.7827.102/.103
2026-06-09: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.