EUVD-2026-34717
GHSA-ccp5-cv37-gvv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryDeliver crafted HTML to browser
-
ExploitExploit separate renderer bug for RCE
-
ExecutionTrigger GPU integer overflow from renderer
-
PersistEscape sandbox into GPU process
-
ImpactExecute code at GPU process privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete prerequisites drawn from the CVE description and CVSS vector: (1) the attacker must have already achieved code execution inside the Chrome renderer process via a separate vulnerability - the GPU bug alone is not directly reachable from a web page; (2) the victim must visit and interact with a crafted HTML page (UI:R), meaning purely passive or drive-by triggering without navigation is not described; and (3) the target must be running Chrome below 149.0.7827.53 with the GPU process active (default configuration, hardware acceleration enabled). The high attack complexity (AC:H) further indicates the integer overflow requires specific timing or memory layout conditions to weaponize reliably, limiting opportunistic mass exploitation. |
| Impact | The CVSS 3.1 score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high impact across confidentiality, integrity, and availability with scope change due to the sandbox escape, but is tempered by high attack complexity (AC:H) and required user interaction (UI:R). The description explicitly states an attacker must have already 'compromised the renderer process,' which is a substantial prerequisite not fully captured by PR:N - in practice this is a second-stage bug requiring a separate renderer RCE. Chromium itself rates the underlying severity as Low, no EPSS data was provided, the CVE is not on CISA KEV, and no POC has been published, so realistic risk is moderate and primarily relevant as a component of a full exploit chain rather than a standalone threat. EPSS, KEV, and POC signals are all absent from the input, so prioritization should rely on the chained-exploit profile and Chrome's standard auto-update cadence. |
| Exploit ScenarioDerived | An attacker lures a victim to a malicious or compromised website that first delivers a separate renderer-process exploit (e.g., a V8 or Blink bug), then chains it with a crafted HTML/WebGL payload that triggers the GPU integer overflow to escape the sandbox and execute code in the GPU process context. From there the attacker can pivot to broader host compromise; no public exploit has been identified at time of analysis, but Chrome sandbox escapes are routinely paired with renderer bugs in commercial exploit chains. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Sandbox escape in Google Chrome's GPU process prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers an integer overflow. The flaw, tagged as a buffer overflow with information disclosure potential, requires user interaction and a chained renderer compromise, and no public exploit has been identified at time of analysis despite Chromium rating the underlying severity as Low.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Stable channel Chrome to this version or later as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in Chromium issue https://issues.chromium.org/issues/498856565. Most installations will receive this automatically via Chrome's background updater; enterprise fleets using GPO or MDM should verify the managed update channel is not pinned to an older version and force a relaunch. As an interim compensating control while patching, disabling hardware acceleration (chrome://settings → System → 'Use graphics acceleration when available' off) routes rendering through the software path and reduces exposure of the vulnerable GPU code, at the cost of degraded WebGL/video performance and higher CPU usage; users of Chromium-derived browsers (Edge, Brave, Opera) should await and apply their respective merged updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's GPU process, the privileged component that handles graphics commands forwarded from sandboxed renderers via the Chrome IPC layer. The root cause is classified under CWE-125 (out-of-bounds read), stemming from an integer overflow during size or index calculations in GPU command processing; when the overflow wraps an arithmetic value, subsequent memory operations read or write outside intended buffer boundaries. Because the GPU process runs at a higher privilege level than the renderer sandbox, memory corruption there enables a cross-process sandbox escape, which is reflected in the CVSS Scope:Changed (S:C) attribute.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability that could allow attackers to break out of the browser security boundary if the renderer process is already compromised. Although no public exploit has been identified at time of analysis, successful exploitation could enable full system compromise; patch all Chrome deployments immediately given the critical nature of sandbox escapes.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB