CVE-2026-7972: Google Chrome Information Disclosure Flaw

CVE-2026-7972 Overview

CVE-2026-7972 is an uninitialized memory use vulnerability [CWE-457] in the GPU component of Google Chrome prior to version 148.0.7778.96. A remote attacker who has already compromised the renderer process can leak cross-origin data by serving a crafted HTML page to a victim. The flaw affects Chrome on Windows, macOS, and Linux. Google rates this issue as Medium severity in the Chromium security policy. Successful exploitation requires user interaction, typically navigation to attacker-controlled content, and depends on a prior renderer compromise as a prerequisite.

Critical Impact
Cross-origin data leakage from GPU memory, undermining the same-origin policy that isolates web content across browser tabs and sites.

Affected Products

Google Chrome versions prior to 148.0.7778.96
Chrome desktop on Microsoft Windows, Apple macOS, and Linux
Chromium-based downstream browsers using the same GPU code path

Discovery Timeline

2026-05-06 - CVE-2026-7972 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-7972

Vulnerability Analysis

The vulnerability is an uninitialized use defect inside Chrome's GPU process. The GPU process handles graphics commands forwarded from sandboxed renderer processes through Chrome's IPC layer. When a memory region is allocated but not fully initialized before being read, residual byte values from prior allocations can be returned to the caller. In a browser context, those residual bytes may include pixel data, texture contents, or buffer fragments associated with documents from other origins. An attacker who controls a renderer can issue specific GPU command sequences that surface this stale data back to JavaScript, breaking the cross-origin isolation guarantees the browser is meant to enforce.

Root Cause

The root cause is a missing initialization step on a memory buffer or GPU resource before it is consumed by a downstream operation. Classified under [CWE-457] Use of Uninitialized Variable, the issue stems from a code path where an allocation reuses memory without zeroing or explicitly writing all expected fields. See the Chromium Issue Tracker Entry for the upstream tracking record.

Attack Vector

Exploitation requires two preconditions. First, the attacker must already have compromised the renderer process, typically through a separate renderer-side vulnerability. Second, the victim must load a crafted HTML page that drives the malicious renderer to issue specific GPU commands. The renderer then reads back GPU output and exfiltrates the leaked cross-origin bytes to an attacker-controlled endpoint. The attack does not require elevated privileges but does require user interaction in the form of page navigation.

Detection Methods for CVE-2026-7972

Indicators of Compromise

Chrome desktop installations reporting a version string lower than 148.0.7778.96 in fleet inventory
Renderer or GPU process crashes correlated with visits to untrusted sites, indicating exploitation attempts of chained renderer flaws
Outbound HTTP/HTTPS POSTs from browser sessions containing binary blobs that resemble image or texture data

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any build below 148.0.7778.96
Hunt for anomalous child process trees originating from chrome.exe --type=gpu-process that exhibit unexpected memory or network behavior
Correlate browsing telemetry with DLP alerts for cross-origin data appearing in outbound web traffic

Monitoring Recommendations

Enable browser version reporting through enterprise management policies and alert on out-of-date installs
Monitor endpoint EDR telemetry for repeated GPU process crashes, which can indicate renderer-to-GPU exploitation chains
Track browser extension and renderer integrity to detect prior-stage compromises that this flaw requires

How to Mitigate CVE-2026-7972

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on Windows, macOS, and Linux endpoints
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or platform MDM
Restart browser sessions after the update to ensure the patched GPU process binary is loaded

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update advisory. Users on Chromium-based browsers should apply vendor updates that incorporate the upstream Chromium patch referenced in the Chromium Issue Tracker Entry.

Workarounds

Disable hardware acceleration via the HardwareAccelerationModeEnabled enterprise policy to reduce GPU process attack surface until patching completes
Restrict browsing to trusted sites using URL allow-lists for high-risk users while updates are deployed
Apply site isolation enforcement through the SitePerProcess policy to limit cross-origin data co-residency in renderer memory

bash

# Configuration example: enforce Chrome auto-update and site isolation via Group Policy on Windows
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v SitePerProcess /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f