Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-78986: Chrome and Chromium may leak cross-origin data via GPU
CVE-2026-78986 · published 2 months ago
Summary
Versions of Google Chrome and Chromium before 152.0.7977.65 have a problem where the graphics processor can be accessed with uninitialized memory. If an attacker already controls a web page's rendering process, they could use a specially crafted page to read data from other websites. Update Chrome/Chromium to the latest version to close the gap.
What to do
- Update google chrome to version 152.0.7977.65 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium | All versions |
| Debian:14 | debian | chromium | All versions |
| – | chrome | < 152.0.7977.65 |
Original advisory text
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML p...
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-908Use of Uninitialized Resource
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen27 Aug 2026
Track software like this
Free during beta