Executive brief
Google Chrome is a widely used web browser. A vulnerability in its graphics processing component could allow a malicious website to corrupt the browser's memory. In practice, an attacker who has already partially compromised the browser's rendering process could use this flaw to gain further control or cause the application to crash.
Technical details
This vulnerability is a use-after-free (CWE-416) within the GPU component of Google Chrome. The flaw is reachable by a remote attacker who has already compromised the renderer process. By enticing a user to visit a specially crafted HTML page, the attacker can trigger the use-after-free condition to perform an out-of-bounds memory write. This could lead to arbitrary code execution outside of the renderer sandbox or a denial-of-service (browser crash). The issue was addressed in Chrome version 148.0.7778.168 for Windows, Mac, and Linux.
Affected products
- Google Chrome Prior to 148.0.7778.168
Timeline
- 2026-04-01: disclosed: Reported to Chromium by Google researchers
- 2026-05-12: patched: Fixed in Stable Channel Update 148.0.7778.167/168
- 2026-05-14: advisory: NVD publication date