EUVD-2026-30467
GHSA-x6r5-rgxm-c9cx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Renderer-to-GPU escalation constitutes a sandbox scope change (S:C); OOB memory write warrants I:H; AC:H reflects mandatory prior renderer compromise prerequisite.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Use-after-free in Chrome's GPU component prior to version 148.0.7778.168 enables an attacker who has already achieved renderer process compromise to perform out-of-bounds memory writes via a specially crafted HTML page. This is a second-stage exploit component embedded within a multi-step browser exploitation chain, requiring a pre-existing renderer foothold before the GPU flaw can be triggered. No active exploitation has been identified - CISA KEV is absent, EPSS probability stands at 0.03% (7th percentile), and SSVC rates exploitation as 'none' - and a vendor patch is confirmed available in Chrome 148.0.7778.168.
Technical ContextAI
The vulnerability (CWE-416, Use After Free) resides in Chrome's GPU process, one layer of the browser's multi-process sandboxed architecture in which the browser, renderer, and GPU processes each operate in isolated sandboxed contexts with escalating OS-level privileges. When memory freed in the GPU process is subsequently accessed through a dangling pointer, an attacker controlling the renderer can craft GPU command streams that trigger an out-of-bounds write into adjacent GPU memory regions. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions prior to 148.0.7778.168. GPU processes historically have broader OS access than the heavily restricted renderer sandbox, making renderer-to-GPU escalation chains a valued primitive in advanced browser exploitation. The Chromium issue tracker reference (https://issues.chromium.org/issues/498715368) is the upstream technical record for this specific defect.
RemediationAI
The primary fix is to update Google Chrome to version 148.0.7778.168 or later, as documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome auto-updates by default; enterprise administrators should verify fleet compliance using Chrome Browser Cloud Management or equivalent tooling and force-push the update where auto-update is disabled. For environments that cannot immediately patch, disabling GPU acceleration via the --disable-gpu command-line flag or the corresponding enterprise policy reduces exposure to GPU process vulnerabilities, though this trade-off carries significant rendering performance degradation and compatibility issues with GPU-intensive web applications. Because exploitation requires prior renderer compromise, organizations should treat mature browser security hygiene - including enforcing Chrome Enhanced Safe Browsing, URL filtering, and prompt patching of renderer-level vulnerabilities - as the primary control that reduces the likelihood of an attacker ever reaching this second-stage vector.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today