EUVD-2026-40517
GHSA-96qm-pj77-hp32
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H and UI:R reflect the required prior renderer compromise plus victim page load; S:U because code stays within the GPU sandbox; C/I/A:H for total impact on the affected component.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Technical ContextAI
The flaw lives in Chrome's GPU process, which handles accelerated 2D/3D rendering, WebGL, WebGPU and compositing for content driven by the untrusted renderer. It is classed as CWE-416 (Use After Free) and manifests as an out-of-bounds read and write: GPU code continues to reference memory whose backing object has been freed, letting an attacker reclaim and control that memory to corrupt adjacent structures and hijack execution. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser across platforms; the crafted HTML page reaches the vulnerable GPU code paths through the browser's normal renderer-to-GPU IPC surface, which is why prior renderer compromise is the stated precondition.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel (Settings → About Chrome to force the update, then relaunch), per Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users of other Chromium-based browsers should apply their vendor's build once it merges the fix. As an interim compensating control you can reduce exposure to the GPU code path by disabling hardware acceleration (Settings → System → 'Use graphics acceleration when available' off, or launch flag --disable-gpu), which forces software rendering and shrinks the attack surface at the cost of degraded rendering performance and battery life; this is a mitigation, not a substitute for patching, since the underlying use-after-free remains. Enterprises can enforce the update through Chrome Browser Cloud Management / group policy to guarantee timely rollout.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today