EUVD-2026-30400
GHSA-6w53-h492-p28f
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted HTML, AC:H for precise lifecycle timing required, UI:R for victim page visit, confidentiality-only impact with no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Process memory disclosure in Google Chrome's Dawn WebGPU engine (prior to 148.0.7778.168) allows a remote attacker to read potentially sensitive data from the renderer process by directing a victim to a crafted HTML page. The flaw stems from an object lifecycle mismanagement in the Dawn graphics layer, falling under CWE-664, and results in high confidentiality impact despite a moderate overall CVSS score due to high attack complexity and required user interaction. No public exploit code has been identified and SSVC assessment indicates no known exploitation activity, placing this in the 'monitor and patch' tier rather than emergency response.
Technical ContextAI
Dawn is Chrome's open-source WebGPU implementation - the GPU abstraction layer that translates WebGPU API calls to native graphics APIs (Metal, Vulkan, D3D12). CWE-664 (Improper Control of a Resource Through its Lifetime) indicates that a GPU-managed or renderer-side object is accessed outside its valid lifecycle - either after destruction (use-after-free semantics) or before proper initialization - causing the engine to return stale or uninitialized memory contents to the JavaScript/WebGPU context. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms that all Chrome desktop releases prior to 148.0.7778.168 across all platforms are in scope. The Chromium issue tracker entry (issues.chromium.org/issues/497594413) is the upstream bug reference, and the Chrome security team classifies severity as Medium.
RemediationAI
The primary remediation is updating Google Chrome to version 148.0.7778.168 or later, confirmed by the Chrome stable channel release blog at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's auto-update mechanism will deliver this to most desktop users automatically; enterprise deployments managing Chrome via group policy or MDM should push the update through their standard patch distribution pipeline. For organizations that cannot immediately update, restricting access to untrusted or external web content via network proxy policies or browser isolation solutions (e.g., remote browser isolation) would reduce exposure, though these controls carry usability trade-offs. Disabling WebGPU via enterprise policy (--disable-webgpu flag or equivalent policy) would address the Dawn attack surface but may break web applications relying on WebGPU features. Red Hat and SUSE enterprise advisories should be monitored for Chromium package updates in those environments.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today