EUVD-2026-13470Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Server-side parameter enforcement
|
| Impact | Without published CVSS vectors or EPSS scores, risk assessment relies on multiple available signals. The vulnerability is classified as High severity by Chromium's internal security review process, indicating significant real-world impact potential. The attack vector is network-based (remote attacker via HTML page), and no special privileges or user interaction beyond visiting a crafted webpage is required. The vulnerability affects a platform-specific component (macOS), which reduces the overall population at immediate risk compared to cross-platform issues. A vendor patch has been released and is available for deployment, indicating this is not an unpatched zero-day. The information disclosure impact is complete (cross-origin data breach), making this a priority for systems handling sensitive web content. Given the availability of a patch and the specific targeting of macOS platforms, this represents a manageable risk with clear remediation path, though organizations with macOS-based Chrome deployments should prioritize patching. |
| Exploit ScenarioDerived | An attacker hosts a malicious website containing a crafted HTML page that exploits the integer overflow in Dawn's WebGPU implementation. When a user on macOS visits this page in Chrome versions prior to 146.0.7680.153, the integer overflow triggers an out-of-bounds memory access that allows the attacker to read data from other browser tabs or origins—for example, stealing authentication tokens from a banking website or session data from cloud services open in other tabs. The attack requires no user interaction beyond visiting the page, and the integer overflow condition can be reliably triggered through careful crafting of WebGPU command buffers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Cross-origin data leakage in Google Chrome's Dawn component on macOS versions prior to 146.0.7680.153 results from an integer overflow vulnerability that can be triggered through a malicious HTML page. An unauthenticated attacker can exploit this to access sensitive information from other origins without user interaction beyond viewing the crafted page. Patches are available for Chrome, Ubuntu, and Debian.
Earlier versions of this analysis (1)
An integer overflow vulnerability in Dawn, Google's WebGPU implementation library used in Chrome, allows remote attackers to leak cross-origin data through a crafted HTML page on macOS systems. Chrome versions prior to 146.0.7680.153 are affected, and this vulnerability is rated as High severity by Chromium security reviewers. While CVSS and EPSS scores are not publicly available, the vulnerability has been patched by Google and tracked across multiple Linux distributions including Debian.
RemediationAI
Immediately upgrade Google Chrome on macOS systems to version 146.0.7680.153 or later. This patch is available through Chrome's automatic update mechanism (Settings > About Google Chrome), which will typically download and apply the update on next restart. For enterprise environments managing Chrome deployments, use the official Chrome release channel at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html to verify patch deployment status. For Debian-based systems, check available updates through your package manager and apply the patched Chrome version once released in your distribution's repositories. Until patching is complete, restrict access to untrusted websites and consider disabling WebGPU features if running an older Chrome version that cannot be immediately patched, though this may impact web application functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Dawn (Chromium's WebGPU implementation), a graphics API abstraction layer that handles GPU-accelerated rendering. Integer overflow vulnerabilities in graphics libraries typically occur in buffer size calculations, memory allocation routines, or coordinate transformations where unsigned integers wrap around to zero or small values when exceeding maximum bounds. CWE-472 (Information Disclosure due to external control of assumed-immutable web content) indicates the root cause involves improper validation of external input that leads to unintended data exposure. The vulnerability allows an attacker to escape the sandboxing protections that normally isolate cross-origin web content, enabling unauthorized access to sensitive data from other origins. This is particularly concerning because WebGPU operations typically run with elevated privileges for GPU access.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Organizations using Dawn in Google Chrome on Mac should be aware of moderate risk from CVE-2026-4453 rated CVSS 4.3. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome 146.0.7680.153 Memory Corruption
View all 26Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Information Disclosure
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| questing | not-affected | code not present |
| upstream | released | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye (security), bullseye | vulnerable | 120.0.6099.224-1~deb11u1 | - |
| bookworm | fixed | 146.0.7680.153-1~deb12u1 | - |
| bookworm (security) | fixed | 146.0.7680.153-1~deb12u1 | - |
| trixie | fixed | 146.0.7680.153-1~deb13u1 | - |
| trixie (security) | fixed | 146.0.7680.153-1~deb13u1 | - |
| forky | vulnerable | 146.0.7680.80-1 | - |
| sid | fixed | 146.0.7680.153-1 | - |
| bullseye | fixed | (unfixed) | end-of-life |
| (unstable) | fixed | 146.0.7680.153-1 | - |
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |
GitHub PoC
Exploit-DB