EUVD-2026-30450
GHSA-rq48-56f4-2ww7
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Delivered via a crafted page (AV:N/UI:R) but non-trivial and dependent on a prior renderer compromise (AC:H); sandbox escape crosses a security boundary (S:C) with full host impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in the GPU process of Google Chrome (and ChromeOS) on Linux, fixed in 148.0.7778.168, lets an attacker who has ALREADY compromised the renderer process break out of the browser sandbox via a crafted HTML page. This is a second-stage bug rather than an initial-access flaw, so it must be chained with a separate renderer exploit to be useful. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC lists exploitation as none, though the technical impact if exploited is total.
Technical ContextAI
The flaw lives in Chrome's GPU process, which handles hardware-accelerated graphics (via the command buffer / GPU driver interface) and runs at a higher privilege than the heavily-sandboxed renderer. An integer overflow - where an arithmetic operation on a size or offset value wraps past its type's maximum, producing a small or negative result used for subsequent memory sizing or indexing - corrupts memory in this more-privileged process. Note a data discrepancy: the description and the 'Buffer Overflow' tag point to an integer-overflow/overflow-driven memory bug (typically CWE-190), but the assigned CWE-472 ('External Control of Assumed-Immutable Web Parameter') does not match that root cause; the Chromium description should be treated as authoritative over the CWE mapping. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Chrome as the affected application, with the described impact scoped to the Linux and ChromeOS platforms.
RemediationAI
Vendor-released patch: 148.0.7778.168 - upgrade Google Chrome (and ChromeOS) to 148.0.7778.168 or later on Linux; on most desktops this arrives automatically, so verify via chrome://settings/help and restart the browser to apply the update, and confirm managed/enterprise deployments have not pinned an older channel. Red Hat and SUSE users should apply the corresponding distribution Chromium/Chrome package updates as they are published. Reference the Chrome release advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. If patching must be delayed, reduce risk by launching Chrome with GPU acceleration disabled (e.g. --disable-gpu) or disabling hardware acceleration in settings, which removes the vulnerable GPU-process code path at the cost of degraded rendering/video performance; because exploitation requires a compromised renderer, standard hardening (site isolation, restricting untrusted browsing, and endpoint monitoring for anomalous GPU-process behavior) also raises the bar until the update is deployed.
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today