EUVD-2026-54120
GHSA-v897-9v5f-fm5j
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape to GPU process; C/I/A:H reflects full host control post-escape.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds write in the GPU process of Google Chrome on Linux enables sandbox escape when an attacker has already compromised the renderer process. Specifically, an attacker controlling the renderer can deliver a crafted HTML page that triggers CWE-787 memory corruption in the GPU process, which operates with higher OS-level privileges than the sandboxed renderer, allowing full sandbox escape. Versions prior to 151.0.7922.109 on Linux are affected; no public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of no public exploit identified at time of analysis.
Technical ContextAI
Google Chrome employs a multi-process architecture where the renderer process is sandboxed and communicates with the GPU process for graphics rendering via IPC. The GPU process interacts directly with OS-level GPU drivers and holds elevated privileges relative to the renderer sandbox. The root cause is CWE-787 (Out-of-bounds Write): attacker-controlled data originating in the compromised renderer causes writes beyond allocated buffer boundaries within the GPU process. Because the GPU process is outside the renderer sandbox boundary, successful exploitation crosses a privilege boundary and constitutes a sandbox escape. The Linux-specific scope - Chrome on Windows and macOS is not affected - suggests the flaw is tied to Linux-specific GPU driver interfaces, memory allocation behavior, or IPC channel handling unique to the Linux build. No CPE string was provided in the input data, but the affected product is confirmed as Google Chrome for Linux prior to version 151.0.7922.109 per EUVD-2026-54120.
RemediationAI
Upgrade Google Chrome on all Linux endpoints to version 151.0.7922.109 or later; this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. The fix is available from vendor and should be applied as the primary remediation. For organizations that cannot patch immediately, the most actionable compensating control is ensuring Chrome's renderer sandbox and Site Isolation (--site-per-process, enabled by default in modern Chrome) remain active and are not disabled by enterprise policy, since this vulnerability requires a prior renderer compromise - hardening the renderer attack surface reduces the likelihood of successfully chaining to this GPU escape. Additionally, restricting Linux endpoints to trusted internal web properties via proxy or DNS filtering reduces exposure to the crafted HTML delivery mechanism. Monitoring for anomalous GPU process crashes or unexpected child process spawning from Chrome may serve as a behavioral indicator of exploitation attempts. Note that none of these mitigations substitute for patching, as a sufficiently motivated attacker with a renderer exploit can still chain to this flaw.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today