EUVD-2026-30399
GHSA-wxm5-8hjp-cm79
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Google Chrome on Linux versions prior to 148.0.7778.168 suffers from an out-of-bounds read vulnerability in GPU processing that enables cross-origin data leakage. An attacker who has already compromised the renderer process can craft malicious HTML to read sensitive memory beyond allocated bounds, exposing data from other origins that should be isolated by the browser's same-origin policy. EPSS exploitation probability is very low (0.03%, 10th percentile) and no active exploitation or public POC has been identified. Google rates this Medium severity and released patch 148.0.7778.168 to address the issue.
Technical ContextAI
This vulnerability affects Google Chrome's GPU process on Linux platforms, specifically the graphics rendering pipeline that handles HTML content. CWE-125 (Out-of-bounds Read) indicates the code attempts to read memory outside allocated buffer boundaries during GPU operations. Modern browsers use multi-process architectures where the renderer process handles page content in a sandboxed environment separate from the browser core. The GPU process performs hardware-accelerated graphics operations and sits between renderer and system GPU drivers. An out-of-bounds read in this component allows attackers who have already escaped renderer sandbox constraints (via a separate compromise) to leak memory contents that may include cross-origin data - violating the Same-Origin Policy that prevents scripts from one domain accessing data from another. The Linux-specific nature suggests the vulnerability involves platform-specific GPU driver interfaces or memory management patterns not present in Chrome's Windows or macOS implementations.
RemediationAI
Update Google Chrome on Linux to version 148.0.7778.168 or later immediately. Chrome's built-in auto-update mechanism should apply this patch automatically for most users - verify by navigating to chrome://settings/help and confirming version number is 148.0.7778.168 or higher. For enterprise deployments using managed Chrome installations, push the update through your software distribution system. The official advisory is available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. No workarounds are available as this is a core GPU processing flaw. If immediate patching is not possible, consider these compensating controls with trade-offs: disabling GPU acceleration via chrome://flags/#disable-accelerated-video-decode reduces attack surface but significantly degrades rendering performance and user experience, particularly for video and graphics-intensive web applications. Restricting user access to untrusted websites through web filtering reduces exposure to malicious HTML but does not address the underlying vulnerability and may impact legitimate business functions. These mitigations are temporary only - patching remains the only complete remediation.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today