CVE-2026-3062: Google Chrome RCE Vulnerability

CVE-2026-3062 Overview

CVE-2026-3062 is an out-of-bounds read and write vulnerability in the Tint component of Google Chrome on macOS. Tint is the WGSL (WebGPU Shading Language) compiler used by Chrome's WebGPU implementation. The flaw affects Chrome versions prior to 145.0.7632.116 and can be triggered by a remote attacker through a crafted HTML page. Successful exploitation allows out-of-bounds memory access in the browser process context, enabling potential code execution, sandbox escape preparation, or sensitive memory disclosure. The vulnerability is tracked under CWE-125 and was addressed in the Chrome Stable channel update for desktop.

Critical Impact
A remote attacker can trigger out-of-bounds memory access via a malicious web page, leading to potential arbitrary code execution and information disclosure on macOS systems running Chrome versions prior to 145.0.7632.116.

Affected Products

Google Chrome on macOS prior to 145.0.7632.116
Apple macOS systems running vulnerable Chrome builds
Chromium-based browsers sharing the affected Tint/WebGPU code path

Discovery Timeline

2026-02-23 - CVE-2026-3062 published to NVD
2026-02-23 - Google releases Chrome Stable channel update for desktop addressing the issue
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-3062

Vulnerability Analysis

The vulnerability resides in Tint, the WGSL shader compiler that translates WebGPU shaders into backend representations such as Metal Shading Language on macOS. Tint parses untrusted shader source supplied by web pages through the WebGPU API. The defect causes the compiler to access memory outside the bounds of an allocated buffer during shader processing. Both read and write operations are affected, expanding the attacker's primitives beyond simple information disclosure.

Because WebGPU is reachable from any origin without special permissions, a remote attacker can serve a crafted HTML page that initializes a WebGPU adapter and submits a malicious shader. The out-of-bounds write provides a path toward memory corruption in the GPU process, which can be chained with additional flaws to escape the Chrome sandbox.

Root Cause

The root cause is improper bounds validation [CWE-125] within Tint's handling of specific WGSL constructs during compilation. Insufficient checks on indices, lengths, or buffer sizes allow the compiler to step past the end of internal data structures while reading or writing.

Attack Vector

Exploitation requires no authentication and no user interaction beyond visiting a web page. The attacker hosts a page that invokes the WebGPU API and submits crafted WGSL shader source. When Tint compiles the shader, the out-of-bounds operation triggers in the GPU process. The vulnerability mechanism is described in the Chromium Issue #483751167 tracker and the Google Chrome Desktop Update advisory. No public proof-of-concept code is currently available.

Detection Methods for CVE-2026-3062

Indicators of Compromise

Chrome GPU process crashes referencing Tint, WGSL, or WebGPU stack frames in macOS crash reports under ~/Library/Logs/DiagnosticReports/.
Outbound connections from Chrome to untrusted domains immediately preceding GPU process termination.
Browser telemetry showing repeated WebGPU adapter requests from unfamiliar origins.

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 145.0.7632.116.
Monitor for anomalous child process behavior spawned by Google Chrome Helper (GPU) such as unexpected file writes or network connections.
Correlate web proxy logs with endpoint crash telemetry to identify pages that consistently crash the GPU process.

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Browser Cloud Management to centralize version and crash data.
Forward macOS unified logs and Chrome crash dumps to a centralized analytics platform for correlation.
Alert on creation of new Chrome Helper processes with abnormal memory regions or thread activity.

How to Mitigate CVE-2026-3062

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 145.0.7632.116 or later immediately.
Restart Chrome after updating to ensure the patched binary is loaded in all browser, renderer, and GPU processes.
Audit managed Chromium-based browsers (Edge, Brave, Opera) for upstream patches incorporating the Tint fix.

Patch Information

Google resolved CVE-2026-3062 in the Chrome Stable channel update for desktop, version 145.0.7632.116. Details are published in the Google Chrome Desktop Update release notes, with the underlying defect tracked in Chromium Issue #483751167. Administrators using Chrome Browser Cloud Management or Mobile Device Management profiles should push the update through enforced auto-update policies.

Workarounds

Disable WebGPU via the enterprise policy WebGpuEnabled set to false until all endpoints are patched.
Block access to untrusted sites through web filtering to reduce exposure to crafted HTML pages targeting WebGPU.
Restrict use of unpatched Chrome builds on macOS through application allowlisting policies.

bash

# Configuration example: disable WebGPU via macOS Chrome enterprise policy
sudo defaults write /Library/Preferences/com.google.Chrome WebGpuEnabled -bool false
sudo defaults write /Library/Preferences/com.google.Chrome DefaultBrowserSettingEnabled -bool true