EUVD-2026-54273
GHSA-j6g7-xqfg-x7xx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects mandatory renderer-compromise prerequisite; S:C captures sandbox escape to GPU/browser process; UI:R because user must load attacker page; PR:N as no target account needed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape via GPU use-after-free in Google Chrome prior to 151.0.7922.109 enables a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox by delivering a crafted HTML page. The vulnerability resides in Chrome's GPU component and, if successfully chained after an initial renderer compromise, yields full confidentiality, integrity, and availability impact on the host system. No public exploit code has been identified at the time of analysis, and SSVC classifies exploitation status as none with automatable set to no, indicating no evidence of active or mass exploitation.
Technical ContextAI
CWE-416 (Use After Free) describes a class of memory-corruption vulnerability where a program continues to reference heap memory after it has been freed. In Chromium's multi-process architecture, the GPU process operates as a privileged broker between the sandboxed renderer and the underlying graphics hardware; a use-after-free in this component can corrupt GPU command buffers or internal state objects, providing a primitive to redirect execution flow. Because the GPU process runs outside the renderer sandbox boundary, successful exploitation crosses the sandbox boundary - reflected in the CVSS S:C (scope change) metric. The affected version range per EUVD is any Chrome build identified as 'Chrome 151.0.7922.109 < 151.0.7922.109', meaning all stable channel releases prior to 151.0.7922.109 across desktop platforms (Windows, macOS, Linux) are in scope.
RemediationAI
Update Google Chrome to stable channel version 151.0.7922.109 or later, which Google confirmed resolves this vulnerability in the advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome's auto-update mechanism should deliver this release automatically on most managed and unmanaged endpoints; administrators should verify via chrome://settings/help that the version is at or above 151.0.7922.109 and that the browser has been fully relaunched to apply the update. For environments where immediate patching is infeasible, a targeted compensating control is to enforce process-level isolation policies (e.g., Windows Defender Application Guard or analogous OS-level sandbox hardening) to limit what a compromised renderer process can reach, though this addresses impact reduction rather than eliminating the vulnerability. Blocking access to untrusted web content via proxy filtering is a further compensating measure but carries significant operational trade-offs for general-purpose workstations. Downstream Chromium-based browser vendors should be monitored for their own patch advisories.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today