EUVD-2026-28003Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious webpage with GFX payload
-
DeliveryUser visits page (via phishing link or ads)
-
ExploitChrome GFX parser processes content
-
ExecutionOut-of-bounds read/write triggered in memory
-
PersistSensitive data leaked or memory corrupted
-
ImpactAttacker exfiltrates data or escalates attack
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User must visit or interact with a webpage containing malicious network content specifically crafted to trigger the GFX out-of-bounds access. The vulnerability does not require authentication or administrator privileges. The attack is not conditional on non-default configuration-all Chrome installations with the vulnerable versions are affected by default. No specific GFX feature or protocol setting must be enabled. The mandatory user interaction (visiting a website or clicking a link) is the primary limiting factor; passive network access alone is insufficient. |
| Impact | CVSS 5.4 with AV:N/AC:L/PR:N/UI:R indicates network-accessible exploitation with low attack complexity but requiring user interaction-a meaningful constraint. EPSS data not provided; however, the combination of signals suggests moderate real-world risk: the vulnerability is in a core rendering system (high impact if triggered), but user interaction is mandatory and the attack vector is network-based malicious content delivery. Chromium's Medium severity rating aligns with CVSS 5.4. The absence of KEV status or public POC at time of analysis indicates this is not yet actively exploited at scale, reducing urgent threat level. However, the simplicity of exploitation (network delivery of malicious content) and the involvement of a fundamental graphics library mean organizations should prioritize patching within normal update cycles rather than treating this as critical. Risk is elevated in environments where Chrome users frequently visit untrusted sites or receive socially engineered links. |
| Exploit ScenarioDerived | An attacker crafts a malicious webpage containing specially formatted GFX data (e.g., a malicious image, SVG, or WebGL command) that triggers an out-of-bounds access when parsed by Chrome's graphics engine. The user visits the page via a phishing link or malicious ad, and the browser automatically processes the content. The attacker reads sensitive memory (e.g., encryption keys, ASLR leaks) or corrupts memory to escalate privileges or trigger a crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 06, 2026
Out-of-bounds read and write in the GFX component of Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary memory read and write operations through malicious network traffic. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but does not require authentication. Chromium rated the security severity as Medium; CVSS 5.4 reflects moderate impact (confidentiality and integrity compromise without availability loss). No active exploitation confirmed in CISA KEV at time of analysis.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.96 and later. Users should update Chrome immediately via Settings > Help > About Google Chrome (automatic update prompt) or manually download from https://www.google.com/chrome/. Organizations can enforce updates via Chrome Enterprise policies or OS-level deployment mechanisms. No workarounds are documented; the out-of-bounds access is not conditional on configuration, so patching is the only mitigation. Note: Chrome's automatic update mechanism typically deploys patches within hours to days, so users with auto-update enabled may already be protected. Verify patch installation by checking chrome://version/ and confirming version ≥ 148.0.7778.96.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Chrome's Graphics (GFX) subsystem, which handles rendering operations and processes graphical data. GFX uses various libraries and protocols to parse and render web content, images, and GPU commands. Out-of-bounds access (CWE-125: Out-of-bounds Read) in GFX typically occurs when the parser fails to validate buffer boundaries before reading or writing memory, allowing an attacker to access adjacent memory regions. This can leak sensitive data (confidentiality) or corrupt memory (integrity). The affected CPE is cpe:2.3:a:google:chrome (all versions prior to 148.0.7778.96 on all platforms), indicating the flaw is platform-agnostic within Chrome releases.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Out of bounds read and write in GFX in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via malicious network traffic. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
GitHub PoC
Exploit-DB