EUVD-2026-105569
GHSA-rxj3-4w4g-7277
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
ExploitLure victim to visit in Chrome
-
ExecutionTrigger GPU memory corruption (CWE-119)
-
ImpactExecute arbitrary code within GPU sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Chrome prior to 156.0.8078.47 to actively open attacker-controlled web content that triggers the crafted rendering path in the GPU process (CVSS UI:R confirms required user interaction). No authentication is needed (PR:N), and default Chrome configurations are affected since GPU/hardware acceleration is enabled by default. Key limiting factor: successful code execution is confined to the GPU sandbox per the description, so meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability - this containment is the primary reason the vendor rates it Medium despite the 8.8 CVSS. |
| Impact | Signals are moderately consistent but point to a lower real-world priority than the raw score suggests. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated, low-complexity exploitation requiring only that a victim open a crafted HTML page - the classic drive-by browser profile. However, the description explicitly scopes code execution to 'inside the sandbox,' and Google's own Chromium severity rating is Medium, both of which indicate the flaw alone does not yield host compromise and must be chained with a separate sandbox-escape to be fully weaponized. This is a notable tension: the 8.8 'High' CVSS overstates standalone impact relative to the vendor's Medium rating and the sandbox-containment language. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. SSVC inputs (automatable, exploitation status) were not provided and cannot be assessed. Net: a credible memory-corruption bug in an ubiquitously deployed browser that warrants prompt patching on the normal Chrome update cadence, but - absent KEV/POC/EPSS evidence and given sandbox containment - not an emergency out-of-band priority on its own. |
| Exploit ScenarioDerived | An attacker lures a victim to a malicious or compromised web page containing specially crafted content that drives Chrome's GPU process into a memory-corruption condition. Exploiting the bug yields arbitrary code execution confined to the GPU sandbox; to escape to the host the attacker would need to chain an additional sandbox-escape vulnerability. No public exploit code is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the GPU process of Google Chrome builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code at the privilege level of the GPU service by convincing a victim to open a crafted HTML page (CVSS UI:R confirms user interaction is required). Because hardware acceleration is on by default, standard desktop installations are exposed without any custom configuration, and the 8.8 base score reflects full confidentiality and integrity impact within that process. Impact is bounded by the GPU sandbox - the vendor's own Medium severity rating and the assessed vector both indicate that escaping to the host requires chaining an additional sandbox-escape flaw; no public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - the vendor has released a patch, published in the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html - and confirm the applied build through chrome://version, since Chrome's background updater can lag and the browser must be fully restarted (not merely relaunched from an already-running process) for the new GPU service binary to take effect. Fleet administrators should force the update via the Chrome Enterprise update policies and verify compliance across endpoints; users of Chromium-derived browsers should wait for their vendor's re-base to Chromium 156.0.8078.47 rather than assuming coverage. Where immediate patching is impossible, the highest-value compensating control is disabling hardware acceleration (chrome://settings/system, or the HardwareAccelerationModeEnabled=false enterprise policy followed by a full restart), which routes rendering through the software path and removes the exposed GPU command-processing surface - at the cost of degraded video, WebGL, and 3D performance plus increased CPU load. A secondary containment option is enforcing a strict site allowlist or blocking untrusted web content, though this is weak given the attack requires only a single crafted page. Because the corruption is contained by the GPU sandbox, maintaining sandbox integrity (no --no-sandbox flags, no disabled site isolation) limits any successful exploitation to the low-privilege GPU process, and reducing reliance on broader host-level privileges provides defense in depth against a subsequent sandbox-escape chain. No vendor workaround short of updating is documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper restriction of operations within the bounds of a memory buffer, occurring inside Chrome's GPU process - the broker that parses untrusted graphics commands and rendering data submitted from web content and relays them to platform graphics drivers (Direct3D/ANGLE, Vulkan, Metal, or GL). Chrome's multi-process architecture renders this process sandboxed, meaning out-of-bounds writes corrupting adjacent heap or object memory yield attacker-controlled execution flow only within that confined service. The attack path is drive-by: a crafted HTML page causes malformed GPU command-buffer traffic or shader/resource state that the GPU service mishandles, and the AV:N/AC:L/PR:N/UI:R vector reflects that the only real precondition is a victim visiting the page in an affected build. The referenced Chromium issue (517031871) and the Chrome stable-channel advisory are the authoritative sources for the internal component and any pointers to the underlying fix; the EUVD record narrows affected installations to Chrome builds below 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth but required user interaction (AV:N/AC:L/PR:N/UI:R); code execution stays within the sandbox so scope is unchanged (S:U) with high C/I/A in that context.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop installations are exposed to a high-severity memory-corruption flaw in the GPU process that can allow a crafted web page to execute code within the GPU service, with broad exposure because hardware acceleration is enabled by default. The business risk is concentrated in browser-borne attacks against ordinary users, though the GPU sandbox limits direct host compromise unless an additional flaw is chained. No public exploit was identified at time of analysis, and a fixed Chrome build is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB