Introduction
A use-after-free vulnerability in Google Chrome's GPU process on Windows lets remote attackers execute arbitrary code inside the browser sandbox. The only thing the attack requires is a victim visiting a crafted HTML page. Chrome holds roughly two thirds of the global browser market, so CVE-2026-9112 exposes a large attack surface that defenders in enterprise and consumer environments need to address promptly.
Technical Information
CVE-2026-9112 is classified under CWE-416: Use After Free. This class of memory-corruption vulnerability occurs when an application keeps referencing a pointer to memory after that memory has been freed or reallocated. Attackers can exploit use-after-free conditions to crash applications, escalate privileges, or execute arbitrary code on affected endpoints.
Here, the vulnerable component is Chrome's GPU process on Windows. The GPU process renders graphical content, including WebGL, hardware-accelerated CSS, and other GPU-intensive operations. When a vulnerable Chrome client renders a specially crafted HTML page, the GPU process incorrectly accesses memory that has already been freed, which creates a dangling pointer that an attacker can manipulate.
Attack Flow
Exploiting CVE-2026-9112 follows a straightforward remote attack pattern:
- The attacker crafts a malicious HTML page designed to trigger the use-after-free condition in Chrome's GPU component.
- The attacker delivers the page to a victim by hosting it on a controlled domain, injecting it into a compromised website, or sending the link through phishing or other social engineering.
- The victim opens the page in a vulnerable version of Chrome on Windows, and the browser's GPU process starts rendering the page content.
- During rendering, the GPU component accesses memory that has already been freed, which produces a dangling pointer.
- The attacker's crafted page manipulates the freed memory region, which enables arbitrary code execution within the Chrome sandbox.
The code execution is confined to the Chrome sandbox, which limits the immediate blast radius. Use-after-free vulnerabilities are a well-understood class of memory-corruption bugs, though, and threat actors frequently chain them with sandbox escape techniques to achieve full system compromise. The CVSS score of 8.8 reflects how serious remote code execution is even inside the sandbox boundary, because it can be a reliable first stage in a multi-step attack chain.
Broader GPU Vulnerability Pattern in Chrome 148
The Chrome 148 release cycle revealed a cluster of GPU-related memory-safety issues, which suggests systemic complexity in the GPU rendering code paths:
| CVE Identifier | Component | Vulnerability Type | Fixed In |
|---|---|---|---|
| CVE-2026-9112 | GPU | Use After Free | 148.0.7778.179 |
| CVE-2026-8546 | GPU | Out of bounds read | 148.0.7778.168 |
| CVE-2026-8581 | GPU | Use After Free | 148.0.7778.168 |
Repeated issues in the same component within a single release cycle warrant continued attention from Google's security team and from organizations that monitor their Chrome deployments.
Affected Systems and Versions
The vulnerability affects Google Chrome on Windows in all versions prior to 148.0.7778.179. Google shipped the fix in the Chrome Stable channel update released on May 19, 2026. The available advisory data does not list other platforms (macOS, Linux, ChromeOS) as affected.
Vendor Security History
Google patches Chrome quickly and on a consistent cadence. The Chrome 148 update alone fixed 127 security vulnerabilities, three of them critical. That is a large number, but finding and fixing these issues within regular release cycles reflects a mature vulnerability management program.
The GPU component has been a recurring source of memory-safety issues. Besides CVE-2026-9112, the same release cycle addressed CVE-2026-8546 and CVE-2026-8581, both also in the GPU component. Outside this release, CVE-2026-5281, a use-after-free in Chrome's Dawn WebGPU component, was confirmed as an in-the-wild zero-day, which shows that attackers are actively targeting this area of the browser.
References
- Stable Channel Update for Desktop (Chrome Releases)
- Chromium Issue Tracker: 489791425
- CWE-416: Use After Free
- CVE-2026-8546 (NVD)
- Chrome 148 Patches 100+ Vulnerabilities (PCWorld)
- Critical New Google Update: 127 Chrome Security Vulnerabilities Confirmed (Forbes)
- Browser Patching Should Not Wait for Chrome Restarts
- CVE-2026-5281: Chrome Dawn Flaw Sparks In the Wild Zero Day Attacks (HivePro)
- What Is a Use After Free Vulnerability? (Automox)
- Google CVEs and Security Vulnerabilities (OpenCVE)
