Description

Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:57.000Z",
  "pubdate": "2026-08-06T22:16:57.000Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write security flaw residing within the GPU component of Google Chrome on Linux.\nThe primary impact of successful exploitation is a potential sandbox escape, allowing an attacker to break out of the restricted renderer process and potentially compromise the underlying host system.\nThe affected product is Google Chrome on Linux prior to version 151.0.7922.109, specifically within the Chromium open-source project architecture.\nThe risk implications are classified as High by Chromium security severity standards, representing a severe threat to browser integrity and OS-level security boundaries.\nAttacker capabilities require a prior compromise of the renderer process, meaning the adversary must already execute arbitrary code within the sandboxed rendering context.\nExploitation requirements include the victim visiting a specifically crafted HTML page designed to trigger the out-of-bounds write condition within the GPU subsystem.",
  "technicalDetails": "The root cause of the vulnerability is an out-of-bounds write flaw located in the GPU component of Google Chrome on Linux.\nThe vulnerable component is the GPU process, which handles hardware-accelerated graphics rendering and compositing operations.\nAffected versions include Google Chrome on Linux prior to 151.0.7922.109.\nAuthentication requirements are none, and network exposure is inherent to web browsing as the attack vector requires processing web content.\nPrivilege requirements dictate that the attacker must have already compromised the restricted renderer process to initiate the attack chain.\nThe attack flow begins when a remote attacker induces a victim to load a crafted HTML page containing malicious content designed to interact with the GPU subsystem.\nUpon rendering the malicious payload, the renderer process interacts with the GPU process via Inter-Process Communication (IPC). Due to improper bounds checking within the GPU component, the crafted input triggers an out-of-bounds write condition.\nThis memory corruption flaw allows the attacker to write arbitrary data outside of allocated buffer boundaries within the GPU process memory space.\nBy manipulating critical data structures or execution flows within the GPU process via this out-of-bounds write, the adversary achieves a sandbox escape, elevating their privileges from the restricted renderer sandbox to the context of the GPU process or beyond.\nPost-exploitation impact includes the potential execution of arbitrary code outside the browser sandbox, leading to a full compromise of the user session on the Linux host system."
}