CVE-2026-9112: Google Chrome GPU Use-After-Free Flaw

CVE-2026-9112 Overview

CVE-2026-9112 is a use-after-free vulnerability [CWE-416] in the GPU component of Google Chrome on Windows. Versions prior to 148.0.7778.179 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a target user. Chromium's security team rated the issue High severity. Exploitation requires user interaction, such as visiting a malicious or compromised website, but no authentication is required. The flaw resides in the GPU process, which handles graphics acceleration tasks for the browser.

Critical Impact

Successful exploitation lets a remote attacker execute arbitrary code inside the Chrome GPU sandbox after a user visits a crafted HTML page, providing a foothold for further sandbox escape attempts.

Affected Products

• Google Chrome on Windows prior to 148.0.7778.179
• Chromium-based browsers using the affected GPU process code paths
• Downstream distributions packaging vulnerable Chromium builds

Discovery Timeline

• 2026-05-20 - CVE-2026-9112 published to the National Vulnerability Database (NVD)
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9112

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's GPU process. Use-after-free occurs when memory is freed but a dangling pointer continues to reference it. An attacker who triggers the freed allocation can place controlled data at the same address. Subsequent dereferences then operate on attacker-controlled memory.

In the GPU process, this primitive can be leveraged to corrupt object state, hijack virtual function tables, or otherwise redirect execution flow. The result is arbitrary code execution inside the GPU process. The GPU process runs inside a sandbox, so initial code execution is contained, but the GPU sandbox is historically a launching point for further exploitation against the broader browser.

Root Cause

The root cause is improper lifetime management of an object referenced by the GPU process. Code paths reachable from rendered web content release a backing allocation while a reference remains live. Refer to the Chromium Issue Tracker Entry for upstream technical context.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page that issues specific graphics or canvas operations to drive the vulnerable GPU code path. Once a user visits the page, the GPU process processes attacker-controlled content and the use-after-free triggers. No verified public exploit is currently associated with this CVE. See the Google Chrome Release Update for vendor disclosure details.

Detection Methods for CVE-2026-9112

Indicators of Compromise

• Unexpected crashes or restarts of the Chrome GPU process (chrome.exe --type=gpu-process) on Windows endpoints running versions earlier than 148.0.7778.179.
• Browser navigation to untrusted domains immediately preceding GPU process crashes or anomalous child process creation from chrome.exe.
• New or unusual outbound network connections initiated by Chrome child processes following GPU process instability.

Detection Strategies

• Inventory installed Chrome versions across Windows endpoints and flag any build below 148.0.7778.179.
• Monitor Windows Error Reporting and crash telemetry for repeated faults in the Chrome GPU process, which can indicate failed or successful exploitation attempts.
• Correlate browser process anomalies with web proxy logs to identify users who visited suspect URLs prior to a crash.

Monitoring Recommendations

• Alert on child process creation from chrome.exe that does not match expected Chrome subprocess types or command-line arguments.
• Track GPU process memory and handle usage spikes that diverge from baseline browser behavior.
• Forward browser telemetry and endpoint process events to a centralized analytics platform for retrospective hunting against newly observed exploit indicators.

How to Mitigate CVE-2026-9112

Immediate Actions Required

• Update Google Chrome on Windows to version 148.0.7778.179 or later across all managed endpoints.
• Force-restart Chrome after deploying the update to ensure the patched binary is active in memory.
• Audit Chromium-based browsers and embedded Chromium frameworks for vulnerable builds and upgrade them to fixed releases.

Patch Information

Google addressed CVE-2026-9112 in Chrome 148.0.7778.179 for Windows. Apply the update through the built-in updater, enterprise management policies, or the Microsoft Endpoint Configuration Manager workflow used in your environment. Patch deployment details are available in the Google Chrome Release Update.

Workarounds

• Restrict browsing to trusted sites using web filtering or URL allow-lists until patching is complete.
• Disable hardware-accelerated graphics in Chrome via the --disable-gpu flag or the HardwareAccelerationModeEnabled enterprise policy to reduce exposure of the GPU code path.
• Enforce site isolation and strict download policies through Chrome enterprise policies to limit attacker reach if exploitation occurs.

# Configuration example: enforce Chrome auto-update and disable GPU acceleration via Windows registry
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f