Description
Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Published: 2026-05-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in Chrome's GPU code on Mac and Windows before 148.0.7778.168. A remote attacker who has already compromised the renderer process can trigger a crafted HTML page to read sensitive data from process memory. This flaw can lead to confidential data leaks. The weakness is identified as CWE‑125.

Affected Systems

Google Chrome on macOS and Windows operating systems, versions earlier than 148.0.7778.168, are affected. This includes all Chrome stable releases prior to that build across the two platforms.

Risk and Exploitability

Chromium labels the flaw as Medium severity with a CVSS score of 5.3. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker first gain control of the renderer process, then serve a malicious HTML page that triggers the out‑of‑bounds read. Given the lack of published exploitation tools, the likelihood remains uncertain, but the medium severity and memory disclosure potential underscore the importance of timely patching.

Generated by OpenCVE AI on May 14, 2026 at 23:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 148.0.7778.168 or later on all affected systems
  • If the update cannot be applied immediately, deploy the Chrome policy ‘disableGpu’ to disable GPU hardware acceleration, thereby mitigating the out‑of‑bounds read vector
  • Apply best‑practice sandboxing and least‑privilege configurations to renderer processes, ensuring they cannot be compromised by other applications

Generated by OpenCVE AI on May 14, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6273-1 chromium security update
History

Fri, 15 May 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Out of bounds read in GPU
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 14 May 2026 23:45:00 +0000

Type Values Removed Values Added
Title Chrome GPU Memory OOB Read Allows Remote Information Disclosure

Thu, 14 May 2026 22:30:00 +0000

Type Values Removed Values Added
Title Chrome GPU Memory OOB Read Allows Remote Information Disclosure
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 14 May 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 May 2026 20:15:00 +0000

Type Values Removed Values Added
Description Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-125
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-14T21:28:32.629Z

Reserved: 2026-05-14T05:40:19.177Z

Link: CVE-2026-8546

cve-icon Vulnrichment

Updated: 2026-05-14T21:28:28.220Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-14T20:17:15.500

Modified: 2026-05-14T22:16:48.557

Link: CVE-2026-8546

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-14T19:52:24Z

Links: CVE-2026-8546 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-14T23:30:31Z

Weaknesses