CVE-2026-19148

Google · Chrome

Google Chrome on Linux is vulnerable to an out of bounds write in the GPU process, which could allow remote attackers to execute arbitrary code.

Executive summary

An out of bounds write vulnerability in the Google Chrome GPU process presents a high risk of remote code execution for Linux users.

Vulnerability

This is an out of bounds write vulnerability located in the GPU process of the browser. It requires user interaction and can be triggered remotely, potentially allowing an attacker to escape the browser sandbox.

Business impact

The vulnerability carries a CVSS score of 8.3, indicating a high risk of system compromise. Successful exploitation could allow an attacker to achieve code execution on the host machine, leading to complete loss of confidentiality, integrity, and availability.

Remediation

Immediate Action: Update the Google Chrome browser on all Linux workstations and servers to the latest patched version.

Proactive Monitoring: Review system logs for signs of abnormal browser process behavior or crashes occurring during web navigation.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to monitor for suspicious child processes spawned by the web browser.

Exploitation status

Public Exploit Available: Unknown.

Analyst recommendation

The complexity and severity of GPU-based vulnerabilities necessitate prompt remediation. Security teams should ensure that all Linux-based Chrome installations are updated immediately to mitigate the risk of remote exploitation and sandbox escapes.