Executive brief
A vulnerability in Google Chrome's Dawn component could allow a malicious website to access sensitive data from other websites you have open. This occurs when a user visits a specially crafted webpage, potentially leading to the exposure of private information across different web domains. Google has released an update to address this issue and protect user data.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in Dawn, the WebGPU implementation in Google Chrome. The flaw is present in versions prior to 148.0.7778.216 on Windows. A remote attacker can exploit this by enticing a user to visit a maliciously crafted HTML page. Successful exploitation allows the attacker to perform a cross-origin data leak, potentially bypassing Same-Origin Policy (SOP) protections to read memory contents. The issue is resolved in Chrome version 148.0.7778.216/217 for Windows.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for desktop
- 2026-05-28: disclosed: CVE published to NVD