Description

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-06T22:16:59.143Z",
  "pubdate": "2026-08-06T22:16:59.143Z",
  "executiveSummary": "An integer overflow vulnerability exists within the GPU component of Google Chrome prior to version 151.0.7922.109. The vulnerability allows a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HTML page. This security flaw carries a severity rating of High within the Chromium security framework. The primary risk implication involves unauthorized information disclosure across security boundaries, potentially exposing sensitive cross-origin data. Exploitation requires the attacker to successfully compromise the renderer process initially and then lure a user to a malicious web page containing the crafted HTML payload. No authentication is required beyond the initial renderer compromise to trigger the GPU integer overflow condition.",
  "technicalDetails": "The root cause of the vulnerability resides in an integer overflow condition within the GPU subsystem of Google Chrome. When handling specific operations related to GPU memory allocation or data processing, the application fails to adequately validate arithmetic calculations, leading to an integer wrap-around. This memory management flaw manifests within the GPU component of the browser architecture, which typically operates with elevated privileges relative to the sandboxed renderer process. The affected software versions comprise Google Chrome builds prior to 151.0.7922.109.\nThe attack flow begins when an attacker achieves initial code execution within the restricted renderer process, likely through a separate vulnerability such as a remote code execution or memory corruption flaw in the JavaScript engine or layout engine. Once the renderer process is compromised, the attacker leverages the crafted HTML page to interact with the GPU process via inter-process communication (IPC). By supplying specially manipulated parameters to the GPU component, the attacker triggers the integer overflow vulnerability during buffer allocation or data transfer operations.\nThe resulting integer overflow causes incorrect memory bounds calculations or buffer sizing errors. This flaw bypasses standard same-origin policy enforcement mechanisms by abusing the GPU process's broader access capabilities. Consequently, the attacker is able to orchestrate a cross-origin data leak, extracting sensitive information from other origins processed by the browser instance. The post-exploitation impact is constrained to unauthorized information disclosure, specifically leaking cross-origin data back to the attacker-controlled renderer context, though this leaked data may include tokens, credentials, or other sensitive user information."
}