EUVD-2026-27927Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Integer overflow in the GPU component of Google Chrome on Android prior to version 148.0.7778.96 enables a remote attacker whose renderer process has been compromised to execute arbitrary read and write operations via a malicious HTML page. The vulnerability requires prior compromise of the renderer process and user interaction, limiting its standalone exploitability but creating a significant secondary threat following renderer exploitation. Chromium security team rated this as high severity; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in Google Chrome's GPU rendering pipeline on Android, specifically an integer overflow condition in GPU memory management (CWE-472: Typical Errors). Integer overflows in GPU contexts allow attackers to bypass memory safety protections and corrupt GPU-accessible memory regions, potentially escalating privileges within the GPU execution context. The affected code path processes specially crafted HTML containing GPU rendering commands that trigger the integer overflow when calculating buffer sizes or offsets. This is a renderer-process-level vulnerability, meaning it requires the attacker to first compromise Chrome's sandboxed renderer process through a separate vector (e.g., JavaScript exploit, parser vulnerability), then leverage this GPU bug to break out of renderer-to-GPU isolation boundaries.
RemediationAI
Update Google Chrome on Android to version 148.0.7778.96 or later immediately via the Google Play Store. Users can verify their current version in Chrome Settings > About Chrome, which will automatically prompt an update if running an older version. No workarounds are available for this vulnerability since it affects a core rendering component; the only mitigation is patching. Users unable to update immediately should avoid visiting untrusted websites or clicking suspicious links, though this provides only partial risk reduction given that the vulnerability requires user interaction with a malicious page. Website administrators may consider implementing Content Security Policy (CSP) headers to restrict GPU-intensive operations, but this is not a complete mitigation. Refer to the official Chrome release notes at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and Chromium issue tracker at https://issues.chromium.org/issues/497639714 for technical details.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today