EUVD-2026-40561
GHSA-9j9m-3v39-2g9x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via HTML page; AC:H for mandatory renderer pre-compromise; UI:R for user visit; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Memory disclosure in Google Chrome's GPU component on Windows enables a remote attacker - who has already established renderer process compromise - to extract sensitive data from process memory via a crafted HTML page. Affected versions are all Chrome for Windows releases prior to 150.0.7871.47. This is a second-stage exploit component: it does not independently achieve remote code execution but can be chained with a renderer exploit to leak process memory contents, potentially exposing credentials, tokens, or other in-memory sensitive data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The flaw resides in Chrome's GPU process on Windows, specifically in the handling of inputs passed from the renderer process to the GPU process via the inter-process communication (IPC) layer. CWE-20 (Improper Input Validation) indicates that the GPU process fails to adequately validate or sanitize data originating from the (potentially untrusted) renderer before acting on it. Chrome's multi-process architecture sandboxes the renderer, but the GPU process is a separate privileged component; renderer-to-GPU IPC messages that carry attacker-controlled values can trigger out-of-bounds reads or unintended memory accesses if not strictly validated. Affected CPE inferred from EUVD: Google Chrome on Windows, versions prior to 150.0.7871.47.
RemediationAI
Upgrade Google Chrome on all Windows systems to version 150.0.7871.47 or later. The vendor-released patch is available via Chrome's built-in updater (chrome://settings/help) or through enterprise deployment tools (Google Update, Intune, SCCM). Consult the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for confirmation. Because exploitation requires a pre-compromised renderer, organizations unable to patch immediately can reduce exposure by enforcing Chrome's existing site isolation (--site-per-process, enabled by default in modern Chrome), which limits renderer compromise blast radius, and by restricting access to untrusted web content via DNS/proxy filtering. Note that site isolation does not eliminate the GPU IPC attack surface; patching is the definitive fix.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today