Google Chrome CVE-2026-11665

Exploitation requires the target to be running Google Chrome on Windows (platform-specific; not confirmed exploitable on macOS or Linux). The attacker must induce the user to visit a crafted HTML page (UI:R per CVSS), which is the sole interaction barrier - this can be accomplished via phishing, malvertising, or a compromised trusted site. No authentication is required (PR:N), and attack complexity is low (AC:L), meaning no race condition or special timing is needed. The limiting factors are: user must actively load the page (no drive-by without interaction), impact is read-only cross-origin data disclosure (no code execution, no integrity impact), and scope is contained to the renderer process (S:U). Exploitation is further limited to Windows-based Chrome instances; other OS deployments are not affected per available data.

The CVSS score of 4.3 (Medium) reflects a constrained but real risk: network-reachable (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but user interaction is required (UI:R) and confidentiality impact is limited (C:L) with no integrity or availability impact. No EPSS score was provided in the available intelligence, which prevents probabilistic exploitation likelihood assessment. There is no CISA KEV listing and no POC code identified, meaning exploitation remains theoretical at time of analysis. The cross-origin data leak potential is noteworthy despite the low CVSS - leaking tab content, authentication tokens, or sensitive DOM data across origins can enable follow-on attacks beyond what the score implies. The Windows-only scope limits exposure compared to a cross-platform issue. The combination of no KEV, no POC, and a vendor patch already available suggests this is a patch-and-move-on priority rather than an emergency response item.

An attacker hosts a crafted HTML page that triggers the Dawn out-of-bounds read when rendered by Chrome's WebGPU pipeline on Windows. When a target user visits the page - via phishing link, malicious ad, or compromised site - the OOB read exposes memory containing cross-origin data such as content from other open tabs, authentication tokens, or rendered page data, which the attacker's JavaScript can then exfiltrate. No public exploit code has been identified at time of analysis, so exploitation currently requires independent vulnerability research to reproduce.