CVE-2026-11006 is an out of bounds read vulnerability in the Dawn component of Google Chrome. It affects Chrome versions before 149.0.7827.53 and can be triggered remotely via a specially crafted HTML page. The vulnerability allows an attacker to read memory outside the intended bounds, potentially exposing sensitive information. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Google has published a stable channel update for desktop Chrome that includes the fix.

Successful exploitation allows a remote attacker to perform an out of bounds memory read, which can lead to disclosure of sensitive information from the browser's memory. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

A fixed version of Google Chrome is available: version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory confirms the availability of this update. No additional mitigation steps are indicated.