This vulnerability (CVE-2026-10968) affects Google Chrome on Windows versions before 149.0.7827.53. It arises from insufficient validation of untrusted input in the Dawn graphics component, enabling a remote attacker with renderer process access to leak cross-origin data through a specially crafted HTML page. The issue is categorized under CWE-20 (Improper Input Validation). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. The vendor advisory linked does not explicitly state patch availability or remediation level.

Successful exploitation could lead to unauthorized disclosure of cross-origin data, compromising user privacy and confidentiality. There is no impact on integrity or availability. The vulnerability requires that the attacker already have compromised the renderer process and that the user interacts with a crafted HTML page. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to version 149.0.7827.53 or later once confirmed patched. Until then, limiting exposure to untrusted content and following standard security best practices for browser use is advisable.