CVE-2026-10968: Chrome Cross-Origin Data Leak in Dawn Graphics Engine (CVSS 7.4)

Technical summary

CVE-2026-10968 involves insufficient input validation in Dawn, Google Chrome's low-level graphics abstraction layer, when running on Windows. The vulnerability allows a compromised renderer process to break cross-origin isolation boundaries and exfiltrate data via a specially crafted HTML page. Dawn's responsibility is translating graphics calls to underlying APIs; weak validation of untrusted input permits an attacker with renderer-level code execution to manipulate graphics operations in ways that leak memory contents across site boundaries. The flaw is classified as CWE-20 (Improper Input Validation), indicating the root cause is insufficient sanitization before processing graphics commands.

Business impact

Data theft from users' browsing sessions represents a material confidentiality risk. If an attacker chains this vulnerability with a separate renderer compromise (such as a browser exploit or malicious extension), they gain the ability to steal authentication tokens, personal information, payment details, or proprietary data visible in the user's tabs. For organizations, this means users accessing sensitive SaaS applications, internal web tools, or cloud services are at risk of session hijacking or credential exfiltration if they are targeted with both a renderer exploit and this cross-origin leak technique.

Affected systems

Google Chrome on Microsoft Windows prior to version 149.0.7827.53 is affected. This includes all 32-bit and 64-bit installations on Windows 7 and later. The vulnerability does not affect Chrome on macOS, Linux, or Android. Users running older Chrome versions and those who have not updated to 149.0.7827.53 or later remain vulnerable.

Exploitability

Exploitation requires two preconditions: (1) the attacker must already have compromised the Chrome renderer process, typically via a separate browser vulnerability or social engineering that installs malicious code, and (2) the user must then visit a page containing the attacker's crafted HTML. The attack vector is network-based and requires user interaction (visiting a webpage), but the barrier to exploitation is medium because the renderer compromise is the harder prerequisite. This is not a remote code execution vector on its own—it is a data-exfiltration technique that amplifies the damage of existing renderer exploits.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Chrome will auto-update on most systems within hours, but users can manually force the update by going to Chrome menu > About Google Chrome, which will check for and install any pending updates. After updating, verify the version number under About to confirm the patch is in place. Organizations should enforce Chrome updates via Group Policy (Windows domain environments) or Mobile Device Management (MDM) for managed endpoints.

Patch guidance

Google Chrome will deliver the patch automatically to most users; no manual download is required. Verify the installed version via Settings > About Google Chrome; the page will auto-refresh and show the new version once installation is complete. For enterprise deployments, administrators should confirm version 149.0.7827.53 or later via Active Directory or MDM console. If you manage Chromebook fleets, standard auto-update policies will apply. No rollback is necessary or recommended; the patch introduces no known incompatibilities.

Detection guidance

Monitor for abnormal renderer process activity, including graphics-related system calls or memory access patterns, via endpoint detection and response (EDR) tools. Check for unauthorized use of graphics APIs (D3D, Vulkan) or unusual cross-origin data requests in network traffic. Browser version audits should confirm all Windows systems running Chrome are at version 149.0.7827.53 or later. Look for web traffic to known malicious or attacker-controlled domains from user systems, as attackers would host the crafted HTML payload. Correlate this vulnerability detection with alerts for other Chrome renderer exploits in your environment to identify coordinated attacks.

Why prioritize this

Although this vulnerability alone cannot be exploited without prior renderer compromise, it significantly amplifies the impact of other browser exploits. Any renderer vulnerability—whether zero-day or patched but uninstalled—becomes a data-theft weapon when combined with this flaw. The CVSS score of 7.4 (HIGH) reflects the confidentiality impact. Organizations should treat this as a medium-to-high priority in a defense-in-depth context: patch immediately to close the exfiltration vector, and simultaneously harden defenses against the renderer exploits that would precede it.

Risk score, explained

The CVSS v3.1 score of 7.4 (HIGH) is driven by high confidentiality impact (C:H) and the low attack complexity (AC:L) of delivering the malicious HTML once renderer access is achieved. No integrity (I:N) or availability (A:N) impact is scored because the flaw only leaks data, not modify it or crash the browser. The network attack vector (AV:N) and requirement for user interaction (UI:R) reflect the realistic delivery mechanism. The scope change (S:C) acknowledges that a compromised renderer can breach the confidentiality guarantees of other web origins. The score does not credit the renderer compromise requirement because CVSS assumes the attack step immediately preceding the vulnerability; however, this context is critical for prioritization.

Frequently asked questions