EUVD-2026-89391
GHSA-86cv-mpfj-pq59
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryCompromise renderer process
-
ExploitTrigger OOB write in GPU process
-
ExecutionCorrupt GPU process memory
-
ImpactExecute code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process as a precondition; only then can a crafted HTML page trigger the GPU-process out-of-bounds write to escape the sandbox. It further requires user interaction (UI:R) - the victim must load attacker-controlled content - and the vector's high attack complexity (AC:H) reflects the non-trivial memory-corruption and chaining conditions needed. Practically, this is a sandbox-escape link in a multi-stage exploit chain, not a standalone remote bug; it is limited to Chrome versions prior to 154.0.8037.92, and a vendor patch closes it. |
| Impact | The CVSS 3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a scope-changing sandbox escape with total confidentiality, integrity, and availability impact, but several signals temper the raw number. The vector encodes high attack complexity (AC:H) and required user interaction (UI:R), and - critically - the description makes clear this is not a standalone remote flaw: the attacker must ALREADY have compromised the renderer process before this GPU out-of-bounds write can be leveraged to escape the sandbox. The PR:N in the vector is Chromium's convention (no browser-level credentials), not an indication of trivial unauthenticated access. CISA's SSVC decision framework aligns with lower urgency: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (the multi-stage renderer-compromise prerequisite defeats mass automation), while Technical Impact is 'total' (consistent with full sandbox escape / code execution). There is no EPSS score provided, no CISA KEV listing, and no public exploit code - exploitation status is 'no public exploit identified at time of analysis.' Net assessment: this is a genuinely serious memory-corruption bug in a ubiquitously-deployed product and should be patched promptly, but it is a second-stage exploit-chain component rather than a one-shot remote-code-execution primitive, so real-world urgency is moderate-to-high rather than emergency. A patch is available from the vendor, which is the decisive mitigating factor. |
| Exploit ScenarioDerived | An attacker first compromises Chrome's renderer process (typically via a separate renderer-level bug), then serves a crafted HTML page that drives the GPU process into an out-of-bounds write, corrupting memory in the higher-privileged GPU process to execute arbitrary code outside the sandbox. Attack complexity is high (AC:H) and user interaction is required (UI:R), and there is no public exploit code identified at time of analysis, so this is realistically part of a sophisticated, chained targeted attack rather than commodity exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
An out-of-bounds write in the GPU process of Google Chrome prior to 154.0.8037.92 allows an attacker to break out of the browser sandbox and potentially execute arbitrary code at the browser's privilege level via a crafted HTML page. The attack is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed exploitation conditions indicate the attacker must have already compromised Chrome's renderer process, and the victim must load attacker-controlled content, making this a sandbox-escape link in a multi-stage exploit chain rather than a directly reachable remote bug. Only Chrome builds below 154.0.8037.92 are affected, and effective exploitation requires overcoming non-trivial memory-corruption and chaining conditions (AC:H); no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Google has released a vendor patch in Chrome 154.0.8037.92.
RemediationAI
Vendor-released patch: Chrome 154.0.8037.92 - upgrade to 154.0.8037.92 or later via the browser's built-in auto-update mechanism, or by downloading the current stable build from Google, and confirm the version under Help > About Chrome; enterprise administrators should push the updated build through their management console and verify fleet-wide version compliance. Chromium-derivative browsers should be updated to a release that incorporates the equivalent upstream fix. Because exploitation requires a pre-existing renderer compromise, the practical interim mitigations are those that make the renderer foothold harder to obtain or contain: keep Site Isolation enabled and avoid relaxing it, disable or tightly restrict unnecessary high-risk extensions and JIT-heavy content, and enforce network-level controls that reduce exposure to attacker-controlled HTML - recognizing that these reduce the likelihood of the required first stage rather than removing the GPU-process defect itself, and none is a substitute for patching. Running Chrome with OS-level sandboxing and exploit mitigations (e.g., modern platform hardening) limits post-exploitation impact but does not prevent the out-of-bounds write. No workaround equivalent to the patch is described in the vendor advisory, so remediation should be treated as mandatory once version 154.0.8037.92 is available; monitor the Chromium issue tracker at https://issues.chromium.org/issues/562004351 and the release advisory for any follow-up updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap/out-of-bounds write (CWE-787) inside Chrome's GPU process, the privileged broker-side component that handles graphics rendering on behalf of untrusted renderer processes. Chrome's security model isolates web content in the renderer sandbox and uses inter-process communication to request GPU services; a memory-safety defect in the GPU process's handling of such requests lets a renderer that has already been compromised corrupt GPU-process memory and potentially execute code outside the sandbox. The CVSS vector's scope change (S:C) captures this boundary crossing - the vulnerable component (GPU process) and the impacted component (the broader operating-system/browser context) differ - and the AC:H rating reflects the careful heap grooming, offset control, and exploitation chaining needed to turn the write into reliable code execution rather than a crash. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* denotes the generic Chrome product line, and EUVD-2026-89391 confirms the affected range as builds earlier than 154.0.8037.92. Google rates the Chromium security severity as High.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted HTML (AV:N) with required user interaction (UI:R) and a compromised-renderer prerequisite plus memory-corruption difficulty (AC:H); sandbox escape crosses a security boundary (S:C) yielding full code execution (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions below 154.0.8037.92 contain a high-severity sandbox-escape vulnerability that could allow code execution at the browser's privilege level if exploited through a multi-stage attack chain. Organizations with unpatched Chrome deployments face potential endpoint integrity and data confidentiality risks, though exploitation requires user interaction and a prior renderer compromise, and no public exploit identified at time of analysis. Leadership should prioritize remediation because Chrome is widely deployed and the vendor has released a patch in version 154.0.8037.92.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB