PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9907 Google CVE debrief

An out-of-bounds read vulnerability in Dawn, the WebGPU implementation in Google Chrome on Windows, enables remote attackers to leak cross-origin data through a crafted HTML page. The vulnerability was assigned High severity by the Chromium security team and affects Chrome versions prior to 148.0.7778.216. The root cause is an out-of-bounds read condition (CWE-125) in the Dawn graphics subsystem, which could allow an attacker to read memory outside intended boundaries when processing malicious WebGPU content. This memory disclosure capability poses a cross-origin data leakage risk, potentially exposing sensitive information from other origins to malicious websites. The vulnerability was addressed in the Chrome Stable channel update released May 28, 2026.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those in environments where users access diverse web content or where WebGPU-enabled applications are in use. Security teams should prioritize this patch due to the High severity rating and the potential for sensitive cross-origin data exposure.

Technical summary

The vulnerability exists in Dawn, Chrome's WebGPU implementation, where an out-of-bounds read condition (CWE-125) can be triggered by malicious HTML content. When exploited, this allows a remote attacker to read memory beyond allocated boundaries, resulting in cross-origin data leakage. The attack vector requires user interaction with a crafted HTML page, and the vulnerability is specific to Chrome on Windows platforms. The fix was released as part of the Stable channel security update on May 28, 2026.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Windows systems to version 148.0.7778.216 or later to remediate this vulnerability
  • Prioritize patching for systems where users access untrusted web content or sites utilizing WebGPU functionality
  • Monitor for unexpected Chrome crash reports or GPU process anomalies that may indicate exploitation attempts
  • Review browser security settings and consider enabling site isolation features as a defense-in-depth measure
  • Assess web application content for unauthorized use of WebGPU APIs that could interact with this vulnerability

Evidence notes

Vulnerability description and affected version confirmed via NVD record and Chrome Release Blog. CWE-125 classification sourced from official vulnerability metadata. Chromium security severity rating of High per CVE description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9907 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9907

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9907 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9907

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.