EUVD-2026-30472
GHSA-5cf7-j3cg-f6cx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted HTML (AV:N); victim must visit the page (UI:R); impact is read-only partial confidentiality leak with no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds memory read in Google Chrome's SwiftShader software GPU rasterizer (versions prior to 148.0.7778.168 on macOS and iOS) exposes limited heap memory contents to a remote attacker who can lure a victim to a crafted HTML page. The root cause is a heap-based buffer overflow (CWE-122) in SwiftShader, Chrome's software fallback rasterizer, triggered during processing of malicious graphics content. No active exploitation is confirmed - CISA KEV is absent, EPSS sits at the 7th percentile (0.03%), and SSVC classifies exploitation as none - making this a low-urgency but patch-eligible finding for macOS and iOS Chrome deployments.
Technical ContextAI
SwiftShader is Google's open-source software rasterizer used as a CPU-based GPU fallback when hardware acceleration is unavailable or restricted, commonly activated on certain macOS and iOS configurations. CWE-122 (Heap-based Buffer Overflow) indicates the overflow occurs in dynamically allocated heap memory; in SwiftShader's context, this is likely within shader compilation or geometry processing routines triggered by GPU-bound WebGL or CSS GPU content. The vulnerability results in an out-of-bounds read rather than write, constraining impact to information disclosure rather than arbitrary code execution. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically versions below 148.0.7778.168 on Mac and iOS as confirmed by EUVD data (EUVD-2026-30472). Tags also indicate SUSE relevance, suggesting downstream Linux distributions may package an affected SwiftShader version, though the CVE description explicitly scopes to Mac and iOS.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.168 or later as the primary fix; this is confirmed by the Chrome Stable Channel release advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's built-in auto-update mechanism will apply this patch automatically for most users - administrators should verify that managed Chrome deployments have auto-update enabled and confirm the installed version has reached 148.0.7778.168 on macOS and iOS endpoints. For environments where immediate patching is constrained, compensating controls include disabling WebGL (via enterprise policy ChromeWebGLEnabled=false), which reduces SwiftShader's attack surface at the trade-off of breaking WebGL-dependent web applications. Blocking access to untrusted external web content via proxy filtering is an additional layer but does not eliminate risk from compromised or malicious first-party sites. SUSE-packaged SwiftShader consumers should monitor SUSE security advisories for a corresponding update.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today