Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-6314: Google Chrome Prior to 147.0.7727.101 Allows Malicious HTML to Escape Security Zones
CVE-2026-6314 · published 6 months ago
Summary
If an attacker has already compromised the Google Chrome GPU process, a malicious HTML page could potentially allow them to break out of the security restrictions that normally prevent them from accessing sensitive system resources. This could lead to further unauthorized access and potentially malicious activity. Update to the latest version of Google Chrome to address this issue.
What to do
- Update debian chromium to version 147.0.7727.101-1~deb12u1.
- Update debian chromium to version 147.0.7727.101-1~deb13u1.
- Update debian chromium to version 147.0.7727.101-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium |
< 147.0.7727.101-1~deb12u1 Fix: upgrade to 147.0.7727.101-1~deb12u1
|
| Debian:13 | debian | chromium |
< 147.0.7727.101-1~deb13u1 Fix: upgrade to 147.0.7727.101-1~deb13u1
|
| Debian:14 | debian | chromium |
< 147.0.7727.101-1 Fix: upgrade to 147.0.7727.101-1
|
Original advisory text
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via a crafted HTML page. (C...
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-787Out-of-bounds Write
Timeline
Published15 Apr 2026
Updated4 Nov 2026
First seen15 Apr 2026
Track software like this
Free during beta