# CVE-2026-84351: Google Chrome buffer overflow in GPU

Source: https://junglewise.ai/threats/cve-2026-84351-google-chrome-buffer-overflow-in-gpu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84351 · Severity: high · CVSS 8.3 · Published 2026-09-02

Google Chrome, a widely-used web browser, contains a buffer overflow vulnerability in its graphics processing unit (GPU) component on Windows. An attacker who has already compromised the browser's renderer process can exploit this flaw to break out of the browser's security sandbox and execute malicious code with full system privileges, potentially compromising the user's entire computer.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-84351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84351 being exploited in the wild.

**How severe is CVE-2026-84351?** High severity, with a CVSS score of 8.3, published 2 September 2026.

**Which products and versions are affected?** Google Chrome prior to 152.0.7977.75.

**Is there a fix for CVE-2026-84351?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84351 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84351?** Check whether you run Google Chrome or Microsoft Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the GPU processing component of Google Chrome on Windows versions prior to 152.0.7977.75. The vulnerability requires an attacker to have already compromised the renderer process (the sandboxed component that interprets web content), and then deliver a specially crafted HTML page to trigger the overflow. Successful exploitation allows arbitrary code execution outside the browser sandbox, effectively bypassing Chrome's primary security boundary. Google has patched this issue in version 152.0.7977.75 and later. The attack vector is network-based but requires the precondition of a prior renderer process compromise.

## Affected products

- Google Chrome prior to 152.0.7977.75

## Timeline

- 2026-09-02: disclosed

## References

- [https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html)
- [https://issues.chromium.org/issues/551593376](https://issues.chromium.org/issues/551593376)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)