EUVD-2026-26662CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.
AnalysisAI
Remote authenticated attackers can execute code or cause persistent denial-of-service in Imagination Technologies Graphics DDK by triggering a use-after-free in the GPU GLES render process via specially crafted WebGPU content. On platforms where the GPU driver runs with elevated system privileges, successful exploitation enables device-level compromise beyond the browser sandbox. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all systems using Imagination Technologies Graphics DDK and document GPU driver privilege levels; restrict WebGPU access on affected systems where feasible through browser policy or disabled hardware acceleration. Within 7 days: Implement application-level controls to block untrusted WebGPU content and conduct risk assessment of affected device categories by deployment context (e.g., shared computing environments vs. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today