EUVD-2026-28070Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via HTML requiring a user page visit; out-of-bounds read causes partial cross-origin data leakage only, no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Dawn WebGPU subsystem (versions prior to 148.0.7778.96) enables remote attackers to read memory beyond buffer boundaries and expose sensitive cross-origin data when a user visits a crafted HTML page. The vulnerability (CWE-125 out-of-bounds read) affects the Dawn graphics abstraction layer, Chrome's implementation of the WebGPU API, and was rated Medium severity by the Chromium security team. No active exploitation has been identified; EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' both confirm low community-assessed real-world risk at time of analysis.
Technical ContextAI
Dawn is Google Chrome's cross-platform WebGPU implementation - a modern graphics and compute API that exposes GPU capabilities directly to web content. An out-of-bounds read (CWE-125) in this subsystem occurs when the Dawn component reads beyond the allocated buffer boundary during GPU resource processing triggered by crafted HTML content, potentially exposing adjacent memory to the calling web context. In a browser security model, this class of memory safety flaw is particularly significant because it can violate the same-origin policy: memory read from outside buffer bounds may contain data belonging to other origins, renderer processes, or browser internals. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to the fixed release 148.0.7778.96. Tags referencing Red Hat and SUSE indicate Chromium packages distributed through those enterprise Linux ecosystems carry the same exposure.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later, the vendor-released patch documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in autoupdate mechanism will deliver this for most desktop users automatically; enterprise deployments using managed Chrome or Chromium should push this version via policy or package management. Red Hat and SUSE administrators should apply the patched Chromium packages from their respective security channels as they become available. As a temporary compensating control prior to patching, restricting user access to untrusted web content via corporate web proxies or Chrome enterprise policies (e.g., URLBlocklist) can reduce exposure to malicious HTML pages exploiting this flaw, though this disrupts general browsing and is not a substitute for the patch. Disabling WebGPU via chrome://flags/#enable-webgpu or the Chrome enterprise policy would eliminate the Dawn attack surface entirely but will break any web applications depending on the WebGPU API.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today