CVE-2026-9907
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An out-of-bounds read vulnerability in the Dawn component of Google Chrome on Windows prior to version 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Risk Assessment
An attacker could exploit this vulnerability to steal sensitive cross-origin data, posing a significant risk to user and organizational data security.
Recommendation
Immediately update Google Chrome to version 148.0.7778.216 or later to remediate the vulnerability.
Other vulnerabilities in Dawn
See all- CVE-2026-14424Critical
A use-after-free vulnerability exists in the Dawn component of Google Chrome on Mac prior to version 150.0.7871.46. A remote attacker could exploit a crafted HTML page to potentially achieve a sandbox escape.
- CVE-2026-14420Critical
A vulnerability in the Dawn component of Google Chrome prior to 150.0.7871.46 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue is an out-of-bounds read and write.
- CVE-2026-14417Critical
A use-after-free vulnerability in Dawn in Google Chrome prior to 150.0.7871.46 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-14416Critical
An out-of-bounds read vulnerability in the Dawn component of Google Chrome prior to version 150.0.7871.46 could allow a remote attacker to potentially escape the sandbox via a crafted HTML page.
- CVE-2026-13934Critical
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-13776Critical
A type confusion vulnerability in the Dawn component of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This issue is rated as Critical in Chromium security.
- CVE-2026-9874Critical
A use-after-free vulnerability in Dawn in Google Chrome prior to 148.0.7778.216 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-79221Medium
Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Severity: Medium)
- CVE-2026-14428High
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-14421Medium
An uninitialized use vulnerability in the Dawn component of Google Chrome on ChromeOS prior to version 150.0.7871.46 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Original NVD description (English source)
Out of bounds read in Dawn in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)