This vulnerability (CVE-2026-11101) is an uninitialized use issue in the Dawn component of Google Chrome on Windows platforms before version 149.0.7827.53. It enables a remote attacker to leak cross-origin data by leveraging a crafted HTML page. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability is categorized under CWE-457 (Use of Uninitialized Variable). The vendor advisory URL is provided but does not explicitly state patch or remediation details.

Successful exploitation can lead to unauthorized disclosure of cross-origin data, impacting user privacy and confidentiality. There is no impact on data integrity or system availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to version 149.0.7827.53 or later once confirmed. Until then, exercise caution with untrusted web content requiring user interaction.