Executive brief
A vulnerability in Imagination Technologies GPU drivers could allow a malicious website to crash a user's browser or graphics process. By using specifically crafted WebGPU content, an attacker can cause the system to miscalculate memory requirements, leading to memory corruption. This could result in service instability or potentially allow for further unauthorized actions on the affected device.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the Imagination Technologies GPU DDK within the GPU GLES render process. The root cause is an integer overflow during memory size calculation based on untrusted input from WebGPU content. When a web page provides specifically crafted "unusual" WebGPU content, the driver computes a required memory size that is smaller than necessary, leading to subsequent writes exceeding the allocated buffer. This results in memory corruption and can trigger a crash of the GPU user-space driver or the browser process. The attack is reachable via the network (web browsing) without prior authentication.
Affected products
- Imagination Technologies GPU DDK
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory