Loading story…
Two newly published vulnerabilities, CVE-2026-22165 and CVE-2026-22166, affect the Imagination Technologies GPU DDK and can be reached from malicious or unusual WebGPU content rendered in a web page. Both issues are classified as CWE-416 use-after-free flaws in the GPU GLES render path and user-space shared library, where crafted content can trigger crashes and memory corruption in the graphics process. The bugs include a write use-after-free in KEGLGetPoolBuffers and additional use-after-free conditions involving GLES3Context::psDrawParams, GLES3Context::psMode, and RMJob::apsCCBs.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-22166 entry was modified the same day it was published to update its CVSS v3.1 vector. The revision lowered confidentiality impact to none while keeping high integrity and availability impact.
Two GPU driver vulnerabilities affecting the GPU GLES render process and user-space shared library were publicly disclosed. Both issues are described as use-after-free flaws reachable via unusual web content and could enable further exploitation on platforms where the graphics workload process has system privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arm disclosed that **CVE-2024-4610** affects Mali **Bifrost** and **Valhall** GPU kernel drivers and is being actively exploited in the wild. The flaw allows a local unprivileged attacker to access deallocated GPU memory, leading to improper GPU memory operations that can expose sensitive data and potentially enable **arbitrary code execution**. The vulnerable versions span **r34p0 through r40p0** for both affected driver lines. Arm and CSIRT.SK urged users and device vendors to update immediately to **r41p0 or later**, with **r49p0** identified as the current version, to mitigate the risk from ongoing exploitation.
Jul 24, 2026
Apple and Red Hat disclosed **CVE-2026-43663**, a moderate-severity `CWE-416` use-after-free flaw in WebKit/WebKitGTK caused by improper memory handling when processing maliciously crafted web content. The vulnerability can be triggered over the network with low attack complexity and no privileges, but it requires user interaction; vendors say successful exploitation can cause an unexpected process crash, creating a denial-of-service condition and potentially broader memory-corruption risks in some scenarios. Apple said it fixed the issue across Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, while Red Hat reported remediation for multiple **RHEL 7, 8, and 9** product streams through security errata and related Bugzilla tracking. Red Hat assigned the flaw a **CVSS v3 score of 6.5** and noted that some older **RHEL 6** packages containing affected components fall outside support scope; the fix was described as improved memory handling in WebKitGTK.
Aug 24, 2026
Google Chrome patched two high-severity heap buffer overflow vulnerabilities, **`CVE-2026-5272`** in the browser's GPU component and **`CVE-2026-5275`** in **ANGLE**, that could allow **remote arbitrary code execution** if a user opened a crafted HTML page. Both flaws are classified as **`CWE-122`** and carry a **CVSS v3.1** rating of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, reflecting low attack complexity and high potential impact to confidentiality, integrity, and availability. The issues affect Google Chrome versions prior to **`146.0.7680.178`**, with impacted platforms listed across **Windows, Linux, and macOS**, while the ANGLE flaw was specifically described as affecting Chrome on Mac. The vulnerabilities were referenced in Google's Chrome stable channel advisory and Chromium issue tracker, underscoring the need for organizations to update browsers promptly to the patched release to reduce exposure to malicious web content.
Jun 29, 2026