PatchSiren cyber security CVE debrief

CVE-2026-9907 Google CVE debrief

An out-of-bounds read vulnerability in Dawn, the WebGPU implementation in Google Chrome on Windows, enables remote attackers to leak cross-origin data through a crafted HTML page. The vulnerability was assigned High severity by the Chromium security team and affects Chrome versions prior to 148.0.7778.216. The root cause is an out-of-bounds read condition (CWE-125) in the Dawn graphics subsystem, which could allow an attacker to read memory outside intended boundaries when processing malicious WebGPU content. This memory disclosure capability poses a cross-origin data leakage risk, potentially exposing sensitive information from other origins to malicious websites. The vulnerability was addressed in the Chrome Stable channel update released May 28, 2026.

Vendor: Google
Product: Chrome
CVSS: MEDIUM 4.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-29
Advisory published: 2026-05-28
Advisory updated: 2026-05-29

Who should care

Organizations with Windows endpoints running Google Chrome, particularly those in environments where users access diverse web content or where WebGPU-enabled applications are in use. Security teams should prioritize this patch due to the High severity rating and the potential for sensitive cross-origin data exposure.

Technical summary

The vulnerability exists in Dawn, Chrome's WebGPU implementation, where an out-of-bounds read condition (CWE-125) can be triggered by malicious HTML content. When exploited, this allows a remote attacker to read memory beyond allocated boundaries, resulting in cross-origin data leakage. The attack vector requires user interaction with a crafted HTML page, and the vulnerability is specific to Chrome on Windows platforms. The fix was released as part of the Stable channel security update on May 28, 2026.

Defensive priority

high

Recommended defensive actions

Update Google Chrome on Windows systems to version 148.0.7778.216 or later to remediate this vulnerability
Prioritize patching for systems where users access untrusted web content or sites utilizing WebGPU functionality
Monitor for unexpected Chrome crash reports or GPU process anomalies that may indicate exploitation attempts
Review browser security settings and consider enabling site isolation features as a defense-in-depth measure
Assess web application content for unauthorized use of WebGPU APIs that could interact with this vulnerability

Evidence notes

Vulnerability description and affected version confirmed via NVD record and Chrome Release Blog. CWE-125 classification sourced from official vulnerability metadata. Chromium security severity rating of High per CVE description.

Official resources

2026-05-28