CVE-2026-102301: GPU out-of-bounds write sandbox escape in Google Chrome · ZeroHour

CVE-2026-102301

mass

GPU out-of-bounds write sandbox escape in Google Chrome

CVSS 3.1

8.3 high

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

CVE-2026-102301 is an out-of-bounds write (CWE-787) in the GPU component of Google Chrome before 154.0.8037.92. A remote attacker who has already compromised the renderer process can trigger it with a crafted HTML page and potentially run arbitrary code outside the sandbox. Impact is high for confidentiality, integrity, and availability, but exploitation needs user interaction and is rated high complexity (CVSS 3.1 8.3; Chromium severity High). Anyone still running an affected Chrome build is in scope. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update Google Chrome to version 154.0.8037.92 or later and confirm the running build in chrome://version or chrome://settings/help. Treat this as a sandbox escape that matters only after a renderer compromise, so do not delay Chrome updates and avoid untrusted pages on builds still below the fixed version.

Affected

Google Chrome

prior to 154.0.8037.92

Estimated exposure

mass≈1 billion+ Chrome installations (unpatched subset unknown) — Google Chrome has a multi-billion-user global installed base and the largest desktop browser share; the exact number still running builds before 154.0.8037.92 is unknown because of automatic updates.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102301

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug