EUVD-2026-33116
GHSA-cjp7-qfwc-w9jj
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's GPU process prior to version 148.0.7778.216 allows remote attackers who have already compromised the renderer process to break out of the Chromium sandbox via a crafted HTML page. The flaw is an out-of-bounds write (CWE-787) rated High by Chromium with CVSS 8.3, and while a vendor patch is available, no public exploit identified at time of analysis and EPSS is very low at 0.03%.
Technical ContextAI
The vulnerability resides in Chrome's GPU process, a privileged component that handles graphics command buffers and shares memory with sandboxed renderer processes via Mojo IPC. CWE-787 (Out-of-bounds Write) typically arises when GPU command parsing, shared-memory buffer validation, or texture/buffer allocation fails to bound-check attacker-influenced indices or sizes, allowing memory corruption in a higher-privileged process. Because the GPU process runs outside the renderer's tight sandbox, corrupting it provides a path out of Chromium's site-isolation boundary. The CPE confirms the affected product is google:chrome across all platforms shipping the vulnerable Chromium build.
RemediationAI
Vendor-released patch: Google Chrome 148.0.7778.216 - update desktop Chrome to this version or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and force-restart browsers to apply staged updates in managed fleets. Downstream Chromium-based browsers should be updated as soon as their vendor ships an equivalent build. If patching must be delayed, partial mitigation is possible by disabling GPU acceleration via the --disable-gpu flag or the chrome://settings 'Use hardware acceleration' toggle to reduce GPU-process attack surface, accepting the trade-off of degraded rendering performance and broken WebGL/WebGPU content; enterprise policies can also enforce site isolation and block untrusted sites via SafeBrowsing/URL allowlists to make renderer compromise harder, which is the required first stage of this chain.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today