Executive brief
Google Chrome is a widely used web browser. A vulnerability in its graphics processing component could allow a remote attacker to crash the browser or cause it to become unresponsive. To exploit this, an attacker would first need to compromise a separate part of the browser's internal processes and then trick a user into visiting a specially crafted website.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within the GPU component of Google Chrome. The flaw is reachable by a remote attacker who has already achieved code execution within a compromised renderer process (a common sandbox escape prerequisite). By providing specifically crafted input to the GPU process via a malicious HTML page, the attacker can trigger a denial of service condition. The issue was addressed in Chrome version 148.0.7778.168 for Windows, Mac, and Linux. While the NVD reports a medium CVSS score, Chromium developers have assigned it a 'High' internal severity rating.
Affected products
- Google Chrome prior to 148.0.7778.168
Timeline
- 2026-03-26: disclosed: Reported to Chrome by Google researchers
- 2026-05-12: patched: Stable channel update released
- 2026-05-14: advisory: NVD publication date