CVE-2026-11091: Critical Chrome Memory Corruption Vulnerability in Dawn Graphics Engine

Technical summary

CVE-2026-11091 stems from an inappropriate implementation in the Dawn graphics abstraction layer within Chrome's rendering pipeline. The flaw permits out-of-bounds memory access when processing specially crafted HTML content, violating memory safety boundaries. The vulnerability maps to CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write), indicating both read and write primitive potential. Attack surface is the network-accessible web rendering path; no elevated privileges or complex user actions beyond visiting a hostile page are required. While Chromium's internal severity assessment is Medium, the CVSS 3.1 vector (8.8 HIGH, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the confluence of network deliverability, low attack complexity, and confidentiality/integrity/availability impact.

Business impact

Exploitation could result in data exfiltration from active browser sessions, credential theft, malware installation, or browser-based lateral movement into corporate networks. Organizations where employees browse untrusted content face risk of compromise without additional user warnings if the attack is sufficiently sophisticated. For SaaS providers and cloud-based applications, this represents a vector for session hijacking or application-level data theft. Patch adoption timelines directly correlate with enterprise exposure duration.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux platforms. All Chrome versions prior to 149.0.7827.53 are in scope. Users of Chromium-based browsers (Edge, Brave, Opera, etc.) that backport Chrome security patches may also be affected; verify vendor advisories for those products. The underlying graphics engine is common across modern Chromium variants.

Exploitability

Exploitability is moderate-to-high in practice. The attack requires crafting malicious HTML that triggers the memory access flaw—a non-trivial engineering effort—but delivers a high-impact outcome. No exploit code is known to be in public circulation based on KEV tracking (this CVE is not yet flagged as actively exploited in the wild). User interaction is mandatory: the victim must visit or be socially engineered to visit a hostile page. Drive-by download scenarios via compromised legitimate websites increase real-world risk. Once deployed, detection evasion is possible if the payload operates within the memory corruption window.

Remediation

Immediately update Google Chrome to version 149.0.7827.53 or later. Chrome auto-updates on restart; enterprises should enforce immediate restarts or use MDM/GPO policies to expedite rollout. Chromium-based browsers should be updated in parallel after confirming patch availability from their respective vendors. For organizations unable to patch immediately, restrict user access to untrusted websites via web filtering, disable JavaScript in non-essential contexts, or isolate high-risk users on sandboxed endpoints.

Patch guidance

1. Verify Chrome version: chrome://version/ in the browser's address bar. 2. For Windows/Mac/Linux: Allow auto-update to complete, or navigate to Settings > About Chrome to force a check. 3. Enterprise deployments: Use Google's Admin Console or your MDM solution to push version 149.0.7827.53+ across endpoints. 4. Confirm successful patching before clearing remediation tickets. 5. For Chromium forks (Edge, Brave, etc.), consult vendor release notes to confirm the equivalent patched version includes this fix.

Detection guidance

Monitor Chrome crash logs and memory violation signals (SEGFAULT, ASAN hits) correlated with web browsing activity. Endpoint detection systems should flag unexpected memory access patterns in chrome.exe/chromium processes, particularly around graphics library calls (dawn_native, d3d11, vulkan backends). Network-level detection is limited; focus on post-breach indicators such as unusual process spawning or credential usage following browsing sessions on untrusted domains. Behavioral analysis of visited sites (yara rules for obfuscated HTML) provides limited early warning. Patch compliance reporting is the most reliable detection proxy.

Why prioritize this

This CVE merits urgent patching despite KEV non-inclusion. The CVSS 8.8 score, network attack vector, low user interaction complexity (visiting a webpage), and memory safety bypass make it a preferred target for sophisticated threat actors. The absence from known-exploited lists does not indicate low risk; it reflects recent publication and pre-incident tracking delays. Combine this with Chrome's ubiquity in enterprise environments and you have a top-quartile risk for lateral movement and data theft.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is justified by: (1) Network Attack Vector—the flaw is reachable via standard web traffic; (2) Low Attack Complexity—no special configuration is needed; (3) No Privileges Required—unprivileged user browsing triggers it; (4) User Interaction Required—moderate friction; and (5) Full CIA Impact—successful exploitation can leak, modify, or disrupt sensitive data and system stability. The delta between Chromium's Medium severity assessment and CVSS's HIGH reflects Google's risk model (limited in-the-wild exploitation) versus a formal scoring framework that weights impact heavily.

Frequently asked questions