EUVD-2026-30462
GHSA-rhxg-9cm5-j9vx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N for web delivery, AC:H for renderer-compromise prerequisite, PR:N as no system privilege needed, UI:R for page visit, C:H for GPU memory disclosure, no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Chrome's GPU process on Mac and Windows exposes process memory to an attacker who has already compromised the renderer. Specifically, a crafted HTML page can be used to trigger the GPU component to read beyond valid memory bounds, leaking potentially sensitive data from GPU process memory. This is a second-stage, chained vulnerability - exploitation requires a pre-existing renderer compromise - and carries no KEV status and a very low EPSS score of 0.03%, indicating no observed widespread exploitation at time of analysis. Patch is available in Chrome 148.0.7778.168.
Technical ContextAI
The vulnerability resides in Chrome's GPU process, a sandboxed component responsible for handling graphics rendering operations. CWE-125 (Out-of-Bounds Read) indicates the GPU process reads data beyond the boundaries of an allocated memory buffer, which can expose adjacent memory contents. Chrome's multi-process architecture separates the renderer process from the GPU process for security isolation; this flaw allows a compromised renderer to send malformed IPC messages or GPU commands that trigger the OOB read in the GPU process. Affected products per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) are Chrome versions prior to 148.0.7778.168 on Mac and Windows. Linux and ChromeOS are not listed as affected platforms. The severity is rated 'High' by the Chromium security team.
RemediationAI
Update Google Chrome to version 148.0.7778.168 or later on all Mac and Windows endpoints immediately, as this is the vendor-confirmed fixed release per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify the rollout via Chrome Browser Cloud Management or Group Policy. If immediate patching is not feasible, restricting access to untrusted websites via web filtering or browser isolation technology reduces the attack surface for the renderer compromise that is a prerequisite to this vulnerability. Disabling GPU acceleration (chrome://flags/#disable-accelerated-2d-canvas) could limit the exploitable surface within the GPU process, but carries significant rendering performance penalties and is not a recommended long-term compensating control.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today