EUVD-2026-40748
GHSA-wcr9-h63p-v2x7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML requiring one user interaction; no auth needed; impact is confidentiality-only memory disclosure with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Process memory disclosure in Google Chrome's Dawn WebGPU component (versions prior to 150.0.7871.47) enables remote attackers to read potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The flaw is categorized under CWE-284 (Improper Access Control) within the Dawn graphics abstraction layer, which underpins Chrome's WebGPU implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and Google's own Chromium security team rates the severity as Low despite the NVD CVSS score of 6.5.
Technical ContextAI
Dawn is Google's open-source, cross-platform WebGPU and WebGL implementation used as the graphics backend in Chromium-based browsers. CWE-284 (Improper Access Control) indicates a failure to correctly restrict access to memory regions during GPU command processing or buffer management, allowing content processed by a crafted page to read out-of-bounds or uninitialized memory from within the renderer process. The 'inappropriate implementation' phrasing is Google's standard language for logic/design flaws rather than classic memory corruption bugs. Affected CPE scope covers Google Chrome desktop releases prior to 150.0.7871.47 across all supported platforms. The Chromium issue tracker reference (issues.chromium.org/issues/502434484) is likely restricted, consistent with Google's standard practice of limiting access until patch rollout.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or via organizational software deployment tools. The vendor patch is confirmed available per the Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For environments where immediate updates are not feasible, compensating controls include enforcing browsing restrictions to prevent users from visiting untrusted or unsolicited external websites, and enabling Chrome's Site Isolation feature (already on by default in modern Chrome) which limits cross-site process memory exposure. Disabling WebGPU via enterprise policy (ChromeFlags or GPUAdapterInfoFlags) would eliminate the Dawn attack surface but may break WebGPU-dependent web applications. Chromium-derived browser vendors (Microsoft Edge, Brave, etc.) should be tracked separately for corresponding patch releases.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today