Executive brief
A security vulnerability exists in Google Chrome for macOS within the Dawn component, which handles graphics processing. An attacker who has already partially compromised the browser's rendering process could use this flaw to bypass security boundaries and access sensitive data from other websites. This could lead to the theft of personal information, login tokens, or other private data handled by the browser.
Technical details
An improper input validation vulnerability (CWE-20) exists in Dawn, the WebGPU implementation in Google Chrome on macOS. The flaw allows a remote attacker who has already compromised the renderer process to bypass Same-Origin Policy (SOP) protections. By enticing a user to visit a specially crafted HTML page, the attacker can exploit insufficient validation of untrusted input to leak sensitive cross-origin data. This vulnerability is specific to the macOS platform and was addressed in Chrome version 149.0.7827.103.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-27: other: Reported to Chrome by Google researchers
- 2026-06-08: patched: Fixed in Chrome Stable channel update 149.0.7827.103
- 2026-06-09: disclosed: Publicly disclosed via NVD and Chrome release blog