CVE-2026-10973

chromium-browser: Uninitialized Use in Dawn

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

A use of an uninitialized variable in the Dawn graphics engine of Google Chrome can allow a remote attacker to read cross‑origin data via a crafted HTML page. The flaw does not grant code execution but leaks confidential information that from another origin. The underlying weakness involves CWE‑457 and the related CWE‑824.

Affected Systems

All users running Google Chrome versions older than 149.0.7827.53 are affected. The vulnerability is listed under the product Google:Chrome and affects any platform that hosts that product. No specific operating systems or architectures are mentioned in the CVE data.

Risk and Exploitability

The issue carries a CVSS score of 7.4, indicating high severity, but an EPSS score of <1% indicates a very low probability of exploitation. The CVE is not listed in the CISA KEV catalog. Exploitation requires a victim to load a maliciously crafted page, so it relies on user interaction or social engineering. While no public exploits are known, a successful data leak could expose sensitive information from cross‑origin contexts.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 149.0.7827.53 or later on all affected platforms.
  • Ensure that the browser is set for automatic or routine updates, or regularly check Google’s release notes for patches.
  • Temporarily reduce exposure by avoiding untrusted web sites that could host malicious HTML content; consider configuring URL filtering or site isolation if available.

Generated by OpenCVE AI on June 18, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
Title chromium-browser: Uninitialized Use in Dawn
Weaknesses CWE-824
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Title Uninitialized Variable in Chrome Dawn Engine Allows Remote Data Leakage
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Uninitialized Variable in Chrome Dawn Engine Allows Remote Data Leakage
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}
Type Values Removed Values Added
Title Uninitialized Variable in Dawn Engine Can Leak Cross‑Origin Data
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Uninitialized Variable in Dawn Engine Can Leak Cross‑Origin Data
Type Values Removed Values Added
Description Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-457
References
Earlier changes (4)
Weaknesses
  • CWE-457

    Use of Uninitialized Variable

  • CWE-824

    Access of Uninitialized Pointer

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 8, 2026, 6:05 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 6, 2026, 2:40 AM

JSON

Status
Modified
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 22, 2026, 8:10 PM

View source JSON

Severity
Important
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 18, 2026, 4:00 AM

JSON