Executive brief
A security vulnerability exists in Google Chrome's Tint component, which is responsible for handling specialized graphics shaders. By tricking a user into visiting a malicious website, an attacker could potentially gain unauthorized access to the browser's memory. This could lead to the theft of sensitive information or the execution of unauthorized commands on the user's device.
Technical details
This vulnerability is classified as an out-of-bounds (OOB) read and write within Tint, the compiler for the WebGPU Shading Language (WGSL) in Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page containing malicious shader code. A remote, unauthenticated attacker can exploit this to achieve arbitrary memory access within the sandboxed renderer process, potentially leading to remote code execution (RCE) or information disclosure. The issue was addressed in Google Chrome version 150.0.7871.46.
Affected products
- Google Chrome prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Chrome 150.0.7871.46 released to stable channel.
- 2026-07-01: advisory: NVD published the CVE record.