Description

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-02T00:18:28.983Z",
  "pubdate": "2026-09-02T00:18:28.983Z",
  "executiveSummary": "This vulnerability is a buffer overflow within the GPU process of Google Chrome on the Windows platform, identified as a high-severity security flaw.\nThe vulnerability occurs within the graphics processing unit handling component, potentially allowing a remote attacker who has already compromised the renderer process to escape the Chromium sandbox.\nBy leveraging a specially crafted HTML page, an attacker can trigger memory corruption, leading to the execution of arbitrary code with privileges exceeding those of the sandboxed renderer.\nThe impact includes full remote code execution outside the restricted sandbox environment, posing a critical risk to system integrity and user security.\nAffected versions include all Google Chrome builds on Windows prior to 152.0.7977.75.\nExploitation requires the attacker to successfully compromise the renderer process first, indicating this is a sandbox escape primitive, likely used as part of a multi-stage exploit chain.",
  "technicalDetails": "The vulnerability resides in the GPU process, which is responsible for hardware-accelerated rendering and composition within the Chromium architecture. A buffer overflow condition exists where incoming data—potentially from IPC messages initiated by the renderer—is not properly bounded before being copied into a fixed-size memory buffer.\nIn the Chromium sandbox model, the renderer process operates with minimal privileges and restricted system access. However, the GPU process maintains a higher level of system interaction to interface with graphics drivers and hardware. This vulnerability effectively serves as a bridge for a sandbox escape, allowing the attacker to transition from the limited execution environment of the renderer into the broader execution context of the GPU process.\nThe attack flow begins with the delivery of a malicious HTML document to the victim's browser. The attacker first exploits a secondary vulnerability within the renderer process (such as a memory corruption flaw in V8 or Blink) to achieve remote code execution within the sandbox. Once renderer-level control is established, the attacker sends crafted IPC (Inter-Process Communication) messages to the GPU process.\nThese messages contain payloads designed to trigger the identified buffer overflow. By overwriting adjacent memory locations—which may include return addresses, function pointers, or objects containing virtual function tables—the attacker can redirect control flow to shellcode or a ROP (Return-Oriented Programming) chain. Because the GPU process runs with the security context of the user, successful exploitation results in arbitrary code execution outside the sandbox, circumventing the primary security boundary intended to contain browser-based threats.\nThe vulnerability affects Google Chrome on Windows versions prior to 152.0.7977.75. The root cause is an insecure handling of input data within the GPU-related communication channels, where the absence of strict bounds checking allows the attacker to exceed the allocated memory region. The post-exploitation impact is severe, granting the attacker the ability to perform operations that the browser's sandbox is explicitly designed to block, including unauthorized file system access, lateral movement, or persistent system compromise."
}