CVE-2026-84351: Google Chrome GPU Buffer Overflow Vulnerability

CVE-2026-84351 Overview

CVE-2026-84351 is a stack-based buffer overflow [CWE-121] in the GPU component of Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.75. An attacker who has already compromised the renderer process can execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page. Chromium classifies the security severity as High.

Sandbox escape vulnerabilities are a critical component of modern browser exploit chains. They allow adversaries to break out of the constrained renderer context and gain the privileges of the browser process on the host operating system.

Critical Impact
Successful exploitation grants arbitrary code execution outside the Chrome sandbox, enabling attackers to escape renderer isolation and operate with browser-level privileges on Windows hosts.

Affected Products

Google Chrome on Windows prior to 152.0.7977.75
Chromium-based browsers on Windows that inherit the vulnerable GPU code path
Deployments running Chrome Stable channel before the fixed release

Discovery Timeline

2026-09-02 - CVE-2026-84351 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84351

Vulnerability Analysis

The vulnerability is a stack buffer overflow located in Chrome's GPU process on Windows. The GPU process handles rendering acceleration, WebGL, and graphics commands issued by renderer processes over the Chromium IPC boundary. Because the GPU process runs at higher privilege than the sandboxed renderer, memory corruption in this component enables sandbox escape.

Exploitation requires the attacker to first compromise the renderer process, typically through a separate memory corruption bug reachable from a crafted HTML page. The attacker then sends malformed graphics commands to trigger the overflow in the GPU process. The high attack complexity reflects the multi-stage nature of this exploit chain and the required user interaction to visit attacker-controlled content.

Root Cause

The root cause is improper bounds checking on stack-allocated buffers within the GPU process when handling data supplied by the renderer. Untrusted input crosses the IPC boundary and overflows a fixed-size buffer on the stack, allowing corruption of adjacent stack memory and control-flow structures. See the Chromium Issue Tracker Entry for further technical context once access restrictions are lifted.

Attack Vector

The attack begins with a victim loading a crafted HTML page in a vulnerable version of Chrome. The attacker leverages a pre-existing renderer compromise to issue malicious GPU commands. These commands trigger the stack overflow in the GPU process, resulting in code execution outside the sandbox. Refer to the Chrome Release Update for vendor guidance.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose above; consult vendor references for additional technical details as they become public.

Detection Methods for CVE-2026-84351

Indicators of Compromise

Unexpected child processes spawned by chrome.exe or the Chrome GPU process, particularly command shells or scripting hosts
GPU process crashes correlated with visits to unfamiliar or low-reputation web content
Outbound network connections originating from the Chrome GPU process to non-Google infrastructure
Chrome installations reporting versions earlier than 152.0.7977.75 on Windows endpoints

Detection Strategies

Monitor process ancestry to identify anomalous descendants of Chrome, especially where the GPU process is the parent
Correlate browser process crashes with subsequent suspicious file writes or persistence changes on the same host
Inspect Chrome version telemetry across the fleet and flag hosts below the patched build

Monitoring Recommendations

Ingest endpoint process telemetry and Chrome version data into a centralized analytics platform for continuous exposure tracking
Alert on Chrome GPU process crashes followed by new process creation within a short time window
Track outbound connections from browser child processes and compare against known Google update endpoints

How to Mitigate CVE-2026-84351

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.75 or later across all managed endpoints
Verify enterprise update policies are enforcing automatic Chrome updates and not deferring the Stable channel
Audit Chromium-based browsers deployed in the environment and apply upstream fixes as vendors release them
Restrict execution of untrusted browsers and enforce endpoint controls that block unsigned or outdated Chrome installations

Patch Information

Google addressed the vulnerability in Chrome Stable channel version 152.0.7977.75 for Windows. Details are available in the Chrome Release Update. Administrators should confirm the deployed version through chrome://settings/help or fleet management telemetry after rollout.

Workarounds

Disable hardware acceleration in Chrome via the --disable-gpu flag or the Settings UI to reduce GPU process exposure, accepting a rendering performance impact
Apply enterprise policies that restrict browsing to trusted domains until patching completes
Enable site isolation and Enhanced Safe Browsing to raise the cost of the initial renderer compromise required by this exploit chain

bash

# Example: enforce Chrome auto-update on Windows via Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
# Verify installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion