Description

Race condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:02.807Z",
  "pubdate": "2026-08-25T21:18:02.807Z",
  "executiveSummary": "This vulnerability involves a race condition within the GPU process of Google Chrome, specifically affecting versions prior to 152.0.7977.65. The flaw is classified as a memory synchronization or logic error occurring during GPU-accelerated operations.\nSuccessful exploitation allows a remote attacker who has already achieved an initial compromise of the renderer process to break out of the browser's security sandbox. By leveraging this race condition, an attacker can transition from restricted execution within the renderer to arbitrary code execution with the privileges of the GPU process.\nThe primary risk implication is a significant escalation of privilege that circumvents the Chromium security model. Exploitation requires the attacker to successfully compromise the renderer process first, often through a separate initial entry point such as a memory corruption vulnerability in the DOM or JavaScript engine. Once the renderer is compromised, the attacker can use a crafted HTML page containing malicious GPU commands to trigger the race condition, leading to potential system-level compromise depending on the sandbox configuration and host environment. The Chromium project has categorized this as a Medium severity vulnerability.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper synchronization mechanism within the GPU process, which handles hardware-accelerated rendering and graphics processing for the browser. In multi-process architectures like Chromium, the renderer process communicates with the GPU process via Inter-Process Communication (IPC). The race condition emerges when the GPU process fails to safely manage state transitions or shared memory resources while processing asynchronous graphics commands from the renderer.\nThe exploitation flow begins with the attacker compromising the renderer process. Once control of the renderer is established, the attacker gains the ability to send arbitrary IPC messages and GPU commands to the GPU process. The attacker then constructs a malicious payload, typically delivered via a crafted HTML page, designed to flood the GPU process with concurrent or malformed commands. This creates a state of contention where the GPU process attempts to access or modify shared memory objects that are not properly protected by mutexes or atomic operations.\nDuring this window of contention, the attacker forces the GPU process to enter an inconsistent state. By precisely timing the delivery of these IPC messages, the attacker can trigger a Use-After-Free (UAF) condition or a heap corruption event. Because the GPU process operates with higher privileges than the renderer—and typically resides outside the restricted renderer sandbox—the successful exploitation of this race condition allows the attacker to redirect execution flow.\nOnce the execution flow is redirected, the attacker can inject shellcode or pivot to arbitrary memory locations to achieve code execution. The impact is significant, as it effectively bypasses the renderer sandbox, allowing the attacker to interact with host-level system resources that are normally inaccessible from the restricted renderer environment. The vulnerability resides specifically within the GPU-related IPC handling or the GPU command buffer implementation within the Chromium codebase. This flaw is present in all versions prior to 152.0.7977.65, and its exploitation does not require pre-existing authentication beyond the initial renderer compromise, which is typically facilitated by the browser visiting a malicious URL."
}