Uninitialized GPU Resource in Google Chrome (pre-154.0.8037.92) Enables Sandbox Escape
AI analysis
Google Chrome versions prior to 154.0.8037.92 contain an uninitialized resource flaw (CWE-908) in the GPU component, rated High severity by Chromium despite a low formal CVSS 3.1 score of 3.4. The bug is triggered when a victim loads a crafted HTML page, but it is a second-stage issue: the attacker must have already compromised the renderer process (e.g., by chaining it with a separate renderer memory-safety bug) before this flaw can be leveraged. Successful exploitation lets the attacker read memory outside the Chrome sandbox, exposing data such as process memory contents and weakening the sandbox boundary that normally contains renderer compromises. All users running Chrome older than 154.0.8037.92 are affected; the fix shipped in the Chrome 154 update that resolved 32 security flaws overall. There is no public proof of concept, the issue is not on CISA's KEV list, and no exploitation in the wild has been reported.
What to do: Update Chrome to 154.0.8037.92 or later immediately (Help > About Google Chrome; consumers on the stable channel generally auto-update within days). Enterprise and education fleets should confirm the rollout via update policy and verify version strings on managed endpoints. If you run Chromium-based third-party browsers (Edge, Brave, Opera, Vivaldi), check for and deploy their corresponding updates, since they share the affected GPU code but ship fixes on their own schedules; no specific version numbers for those vendors were provided in this advisory.
Affected
| Google Chrome | < 154.0.8037.92 |
Estimated exposure
mass≈3 billion Chrome installations/users potentially affected prior to updating — Chrome holds roughly two-thirds of global browser market share across desktop and mobile, which translates to billions of installations; the affected population is that base minus whatever fraction has already auto-updated to 154.0.8037.92…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.