CVE-2026-11086

chromium-browser: Insufficient validation of untrusted input in Dawn

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

In Google Chrome versions prior to 149.0.7827.53, an inappropriate implementation within the Dawn graphics engine lets a malicious actor who has already compromised the renderer process run arbitrary code inside the browser’s sandboxed environment. The flaw allows exploitation through a specially crafted HTML page, giving attackers the ability to execute code with the renderer’s privileges.

Affected Systems

Vendors affected are Google Chrome. Any client running Chrome below version 149.0.7827.53 is vulnerable. Versions 149.0.7827.53 and later include the fix.

Risk and Exploitability

The EPSS score is 0.00106, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an initial compromise of the renderer, after which a crafted HTML page can trigger the flaw. Given a CVSS score of 8.8, the risk is high for users who may visit untrusted web content. No publicly known active exploits are documented at this time.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 149.0.7827.53 or later.
  • Enable policies or extensions that restrict renderer privileges and prevent untrusted HTML content from loading.
  • Educate users to avoid clicking on suspicious links or downloading untrusted files that could contain malicious HTML.

Generated by OpenCVE AI on June 7, 2026 at 15:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Dawn
Weaknesses CWE-94
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Type Values Removed Values Added
Title Dawn Renderer Sandbox Escalation via Crafted HTML
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Dawn Renderer Sandbox Escalation via Crafted HTML
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References
Earlier changes (2)
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 6, 2026, 3:56 AM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 5, 2026, 12:40 AM

JSON

Status
Analyzed
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 3:30 PM

JSON