EUVD-2026-30452
GHSA-qg42-2p2w-r3v5
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
AC:H captures mandatory prior renderer compromise; PR:N as no target system privileges are needed; UI:R for required page visit; availability-only impact from browser crash with unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform a denial of service via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Denial of service in Google Chrome's GPU process prior to 148.0.7778.168 allows a remote attacker who has already compromised the renderer process to crash the browser by passing malformed input through a crafted HTML page. This is a chained, post-exploitation DoS - not a standalone attack - requiring a prior renderer breach as an explicit prerequisite. No public exploit code has been identified, CISA KEV does not list this CVE, and EPSS sits at 0.06%, all consistently signaling low real-world priority.
Technical ContextAI
Google Chrome uses a multi-process architecture that isolates the renderer, GPU, and browser processes from one another for sandboxing purposes. This vulnerability (CWE-20 - Improper Input Validation) resides in the GPU process, which handles hardware-accelerated rendering instructions forwarded from the renderer. When the renderer has been compromised, an attacker can craft malicious GPU command inputs that the GPU process fails to adequately validate, resulting in a process crash. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 148.0.7778.168. Tags referencing Red Hat and SUSE indicate that downstream Chromium packaging in Linux distributions is also affected.
RemediationAI
The primary fix is upgrading Google Chrome to version 148.0.7778.168 or later, as documented in the official stable channel release advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. This is a vendor-released patch; the exact fix version is confirmed. Users on Red Hat- or SUSE-based Linux systems should apply the updated Chromium package through their distribution's package manager once the downstream packages are published. As a compensating control prior to patching, enabling Chrome's strict site isolation (--site-per-process) and ensuring renderer sandboxing is active raises the bar for the prerequisite renderer compromise, indirectly reducing the attack surface for this GPU-layer flaw. Disabling hardware GPU acceleration (chrome://flags/#disable-accelerated-2d-canvas) would eliminate the vulnerable code path but will significantly degrade rendering performance and is not recommended for general use.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today