This vulnerability, tracked as CVE-2026-11091, affects Google Chrome versions before 149.0.7827.53. It is caused by an inappropriate implementation in the Dawn component, which can be triggered by a crafted HTML page to perform out-of-bounds memory access. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability corresponds to CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The vendor advisory URL is provided but does not explicitly state if a fix has been released or if the issue is mitigated.

Successful exploitation could allow a remote attacker to execute out-of-bounds memory access, potentially leading to arbitrary code execution or denial of service. The impact affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation of a fix, users should exercise caution when visiting untrusted websites and consider applying any available Chrome updates promptly once released.