Loading vulnerability…
GPU Integer Overflow in Google Chrome
CVE-2026-19167 is an integer overflow vulnerability in the GPU component of Google Chrome versions prior to 151.0.7922.109. A remote attacker who has already compromised a renderer process can exploit the vulnerability through a crafted HTML page to leak cross-origin data. Chromium classifies the vulnerability as High severity. The specific vulnerable function and arithmetic operation are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality by exposing cross-origin data to an attacker who has already compromised a renderer process. Arbitrary code execution or denial of service is not established for this specific vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, restrict access to untrusted web content and unnecessary browser extensions, and retain browser sandboxing and exploit-protection controls. These measures reduce exposure but do not correct the integer overflow.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.109 or later, restart the browser, and verify that the update has been applied across managed devices. For Debian stable (trixie), install the Chromium security update at version 151.0.7922.108-1~deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.