CVE-2026-9113: Google Chrome GPU Out of Bounds Vulnerability

CVE-2026-9113 Overview

CVE-2026-9113 is an out-of-bounds read vulnerability [CWE-125] in the GPU component of Google Chrome on macOS. The flaw affects Chrome versions prior to 148.0.7778.179. A remote attacker can trigger the issue by serving a crafted HTML page to a target user. Successful exploitation allows the attacker to read memory outside the intended bounds of a GPU process buffer. Chromium rates this issue High in its internal severity scale, while NVD assigns it a Medium severity rating.

Critical Impact

A remote attacker can read process memory from the Chrome GPU process by luring a user to a malicious HTML page, potentially exposing sensitive in-memory data.

Affected Products

• Google Chrome on macOS prior to 148.0.7778.179
• Chromium-based browsers incorporating the vulnerable GPU code
• Embedded applications using affected Chromium builds on macOS

Discovery Timeline

• 2026-05-20 - CVE-2026-9113 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9113

Vulnerability Analysis

The vulnerability resides in the GPU process of Google Chrome on macOS. The GPU process handles rendering, WebGL, and hardware-accelerated graphics operations on behalf of renderer processes. An out-of-bounds read occurs when code reads data past the end or before the beginning of an allocated buffer. In this case, a crafted HTML page triggers GPU processing that reads outside the bounds of an intended memory region. The attacker requires user interaction, since the victim must visit a page hosting the exploit. The disclosed memory may contain pointers, tokens, or other data useful for chaining with additional vulnerabilities.

Root Cause

The defect is classified as [CWE-125] Out-of-bounds Read. The GPU code accepts attacker-influenced input and uses it as part of a memory access without validating that the resulting offset or length stays within the allocated buffer. Google has not published low-level technical details for this issue, and the Chromium Issue Tracker Entry remains restricted at this time.

Attack Vector

Exploitation requires the victim to load a malicious HTML page in a vulnerable Chrome build on macOS. The page issues graphics or compute operations that reach the vulnerable GPU code path. No authentication is required, and the attack proceeds over the network. The impact is limited to confidentiality, since the flaw enables memory disclosure rather than code execution or memory corruption on its own.

No public proof-of-concept code is available. See the Google Chrome Update Announcement for vendor-provided context.

Detection Methods for CVE-2026-9113

Indicators of Compromise

• Chrome installations on macOS reporting versions earlier than 148.0.7778.179
• Browser telemetry showing unexpected GPU process crashes or restarts when loading specific external pages
• Outbound connections from end-user macOS hosts to newly registered domains hosting heavy WebGL or canvas content

Detection Strategies

• Inventory Chrome versions across the macOS fleet and flag hosts below 148.0.7778.179 for remediation
• Correlate GPU process crash logs in ~/Library/Logs/DiagnosticReports/ with browsing history to identify suspect URLs
• Monitor web proxy logs for users visiting unknown sites that serve unusual WebGL, WebGPU, or canvas payloads

Monitoring Recommendations

• Ingest endpoint browser version data into a centralized data lake for continuous version compliance checks
• Alert on repeated Chrome GPU process termination events on the same macOS host
• Track threat intelligence feeds for indicators tied to Chrome GPU exploitation campaigns

How to Mitigate CVE-2026-9113

Immediate Actions Required

• Update Google Chrome on all macOS endpoints to version 148.0.7778.179 or later
• Force-restart Chrome after the update to ensure the GPU process loads patched code
• Verify deployment through managed software inventory and remove outdated Chrome installers from internal distribution shares

Patch Information

Google released the fix in the Chrome Stable channel update referenced in the Google Chrome Update Announcement. macOS users must run Chrome 148.0.7778.179 or later. Chromium downstream projects should rebase to the corresponding patched commit before redistribution.

Workarounds

• Restrict browsing to trusted sites via web filtering until patches are deployed
• Disable hardware acceleration in Chrome settings to reduce exposure of the GPU process to untrusted content
• Apply MDM policies that enforce automatic Chrome updates on managed macOS devices

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Temporarily disable hardware acceleration via policy (managed macOS)
defaults write com.google.Chrome HardwareAccelerationModeEnabled -bool false