CVE-2026-84351 in Chrome
Summary
by MITRE • 09/02/2026
Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Google Chrome for Windows, specifically prior to version 152.0.7977.75, represents a critical failure in memory safety within the graphics processing unit subsystem. This buffer overflow flaw allows an attacker who has already achieved code execution within the renderer process sandbox to escalate privileges and execute arbitrary commands outside of that restricted environment. The severity is classified as high by Chromium security standards due to its potential for remote exploitation through standard web content, thereby undermining one of the primary defense mechanisms in modern browsers: the multi-process architecture with strict sandboxes designed to isolate untrusted code from the operating system core.
From a technical perspective, buffer overflows occur when a program writes more data to a fixed-length block of memory than it can hold. In this specific instance, the flaw resides within the GPU-related components that handle rendering operations for HTML pages. When a user visits a maliciously crafted webpage containing specially constructed graphics commands or shaders, the browser's renderer process processes these inputs without adequate bounds checking. This lack of validation allows an attacker to overwrite adjacent memory locations, potentially overwriting function pointers or return addresses on the stack. By carefully crafting the payload, an attacker can redirect the execution flow of the compromised renderer process to point to their own shellcode, which is then executed with higher privileges than those granted by the sandbox.
The operational impact of this vulnerability is significant because it effectively neutralizes the browser's primary security boundary. Modern browsers rely on a model where each tab or site runs in its own isolated process with limited permissions. If an attacker can escape this renderer sandbox, they gain the ability to interact directly with the host operating system. This could lead to full system compromise, including the installation of malware, theft of sensitive data stored locally, and use of the infected machine as part of a botnet. The fact that the exploit requires only a crafted HTML page means it can be delivered via phishing emails, malicious advertisements, or compromised websites without requiring any additional user interaction beyond visiting the URL.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-120, which describes buffer copy without checking size limits, and more specifically relates to stack-based buffer overflows that facilitate control flow hijacking. In terms of the MITRE ATT&CK framework, this exploit leverages techniques associated with privilege escalation and sandbox escape, such as T1055 (Process Injection) or T1218 (Signed Binary Proxy Execution), depending on how the shellcode is deployed after gaining out-of-sandbox access. The attack vector falls under Remote Code Execution via a Web Application, highlighting the persistent risk posed by complex software stacks that integrate hardware acceleration features like GPU rendering.
Mitigation strategies primarily involve applying the vendor-provided patch immediately to update Google Chrome to version 152.0.7977.75 or later. This release contains code changes that enforce stricter memory bounds checking within the GPU processing pipeline, ensuring that input data from HTML pages is validated before being passed to lower-level system components. Organizations should also consider implementing application control policies to restrict the execution of unsigned scripts and monitor for unusual process behavior indicative of sandbox escape attempts. Additionally, keeping all browser plugins and extensions updated is crucial, as they can sometimes introduce additional attack surfaces if not properly isolated from the core rendering engine. Regular security awareness training for users regarding suspicious links remains a vital complementary defense against initial access vectors that lead to such exploits.