# CVE-2026-11676: Google Chrome improper input validation in Dawn

Source: https://junglewise.ai/threats/cve-2026-11676-google-chrome-improper-input-validation-in-dawn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-11676 · Severity: info · Published 2026-06-09

Google Chrome is a widely used web browser. A security vulnerability in its Dawn component (the engine responsible for WebGPU graphics) could allow a malicious website to break out of the browser's security sandbox. If successful, an attacker who has already compromised the browser's rendering process could gain broader access to the underlying Linux or ChromeOS system, potentially leading to unauthorized data access or full system compromise.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Google ChromeOS](https://junglewise.ai/threats/technologies/chromeos). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-11676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11676 being exploited in the wild.

**How severe is CVE-2026-11676?** Informational severity, published 9 June 2026.

**Which products and versions are affected?** Google Chrome prior to 149.0.7827.103; Google ChromeOS prior to 149.0.7827.103.

**Is there a fix for CVE-2026-11676?** A patch was published on 2026-06-08: Fixed in Stable Channel Update 149.0.7827.102/.103 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11676 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-11676?** Check whether you run Google Chrome or Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the Dawn component of Google Chrome for Linux and ChromeOS. Dawn is the implementation of the WebGPU standard in Chromium. The vulnerability is reachable by a remote attacker who can entice a user to visit a specially crafted HTML page. A successful exploit requires the attacker to have already achieved code execution within the sandboxed renderer process; from there, the insufficient validation in Dawn allows for a sandbox escape to the browser process or host operating system. Google has addressed this in version 149.0.7827.103.

## Affected products

- Google Chrome prior to 149.0.7827.103
- Google ChromeOS prior to 149.0.7827.103

## Timeline

- 2026-05-27: disclosed: Reported to Chrome by Google researchers
- 2026-06-08: patched: Fixed in Stable Channel Update 149.0.7827.102/.103
- 2026-06-09: advisory: NVD publication date

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html)
- [https://issues.chromium.org/issues/516949298](https://issues.chromium.org/issues/516949298)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)