What is the CVSS score of CVE-2026-11101?

CVE-2026-11101 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11101?

Yes, a patch is available for CVE-2026-11101. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11101

EUVD-2026-34562 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-g9jf-rqr3-222g

Information Disclosure Google Microsoft Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:27 vuln.today

CVSS changed

Jun 06, 2026 - 04:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory use in the Dawn WebGPU engine of Google Chrome on Windows (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to leak cross-origin data from a victim's browser session. Exploitation requires the victim to visit a crafted HTML page, breaking same-origin isolation by surfacing residual memory contents from other browsing contexts. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation probability; however, the High confidentiality CVSS impact warrants prompt patching in environments handling sensitive cross-origin data.

Technical ContextAI

Dawn is Google Chrome's cross-platform WebGPU implementation - a low-level graphics and compute API abstraction layer. CWE-457 (Use of Uninitialized Variable) indicates that Dawn allocates GPU-side or CPU-side buffers without zeroing them before handing control to web-accessible JavaScript/WebGPU operations. On Windows specifically, memory allocation patterns may leave residual contents from prior allocations - including data belonging to other web origins - readable through WebGPU API calls. This breaks the browser's same-origin isolation guarantee at the graphics subsystem level rather than the DOM/JS engine level, making it a hardware-adjacent information disclosure rather than a classic scripting flaw. The affected CPE covers Google Chrome on the Windows platform for all releases prior to the 149.0.7827.53 stable channel build.

RemediationAI

The primary fix is upgrading Google Chrome on Windows to version 149.0.7827.53 or later, as documented in Google's Stable Channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's built-in auto-update will handle this silently for most consumer deployments; enterprise administrators should verify deployment via Google Admin Console or push the update through fleet management tooling. If immediate patching is not feasible, disabling WebGPU in Chrome via the enterprise flag --disable-gpu or setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled can remove the attack surface, though this will break WebGPU-dependent web applications and is not a long-term substitute for patching. Restricting end-user navigation to untrusted or external web content via URL filtering provides an additional layer of defense given the UI:R exploitation prerequisite.