CVE-2026-2315
📋 TL;DR
This vulnerability in Chrome's WebGPU implementation allows attackers to access memory outside intended boundaries via malicious web pages. It affects all users running vulnerable Chrome versions, potentially leading to data exposure or system compromise. The high CVSS score reflects significant risk.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution, data theft, or browser sandbox escape leading to host-level attacks.
Likely Case
Browser crash, data leakage from browser memory, or limited code execution within browser context.
If Mitigated
No impact if Chrome is updated or WebGPU is disabled; isolated browser process limits host system damage.
🎯 Exploit Status
Exploitation requires user to visit malicious webpage; no authentication needed. WebGPU complexity makes exploitation non-trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 145.0.7632.45 or later
Vendor Advisory: https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_10.html
Restart Required: Yes
Instructions:
1. Open Chrome settings 2. Click 'About Chrome' 3. Allow auto-update or manually update 4. Restart Chrome when prompted
🔧 Temporary Workarounds
Disable WebGPU
allTemporarily disable WebGPU feature to prevent exploitation
chrome://flags/#enable-webgpu
Set to 'Disabled'
Relaunch Chrome
Use Chrome Enterprise policies
enterpriseDisable WebGPU via group policy for enterprise deployments
Set 'WebGPUEnabled' policy to false
🧯 If You Can't Patch
- Use browser isolation solutions or virtual browsers for high-risk activities
- Implement strict web filtering to block untrusted sites
🔍 How to Verify
Check if Vulnerable:
Check Chrome version in settings; if below 145.0.7632.45, system is vulnerableCheck Version:
chrome://versionVerify Fix Applied:
Confirm Chrome version is 145.0.7632.45 or higher after update📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with WebGPU-related errors
- Unusual memory access patterns in browser logs
Network Indicators:
- Requests to known exploit hosting domains
- Unusual WebGPU API calls
SIEM Query:
source="chrome_logs" AND ("WebGPU" OR "out of bounds")