CVE-2026-12033: Chrome VideoCapture Out-of-Bounds Read (GPU Process)

Technical summary

CVE-2026-12033 is a CWE-125 out-of-bounds read vulnerability in Chrome's VideoCapture module. The flaw exists in how Chrome handles memory access within the GPU process boundary. An adversary with GPU process code execution can trigger the out-of-bounds read through a malicious HTML page, extracting adjacent memory contents without bounds checking. The vulnerability requires the GPU process to already be compromised and the user to visit or interact with a crafted webpage. Chrome version 149.0.7827.115 and later include the fix.

Business impact

The practical risk depends on your threat model. This is not a primary attack vector—it requires an attacker to first compromise Chrome's GPU process, then deliver a malicious webpage to the victim. If your organization runs Chrome on systems processing sensitive data (e.g., financial, healthcare, or classified information), a successful exploit chain could expose that data to an attacker already inside the GPU sandbox. However, the need for prior GPU compromise significantly limits the number of realistic attack scenarios. The CVSS 5.3 medium score reflects these conditions.

Affected systems

Google Chrome (all platforms prior to version 149.0.7827.115), Apple macOS systems running vulnerable Chrome versions, Linux systems with vulnerable Chrome, and Microsoft Windows systems with vulnerable Chrome. The vulnerability affects Chrome on all operating systems; the OS itself is not vulnerable, only Chrome.

Exploitability

Exploitation is feasible only under specific preconditions: the attacker must have already achieved code execution in Chrome's GPU process (typically through a separate vulnerability), and the victim must then visit a malicious webpage. The attack requires user interaction (opening a webpage) and relies on high attack complexity. This is not a wormable vulnerability and does not enable privilege escalation or lateral movement on its own. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects that confidentiality impact is high, but only within the GPU process memory sandbox.

Remediation

Update Google Chrome to version 149.0.7827.115 or later on all affected systems. Chrome's auto-update mechanism typically delivers the fix automatically within hours to days depending on user restart patterns. For organizations with managed Chrome deployments, push the update through your device management platform. No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome version 149.0.7827.115 or later using your standard patch management process. For enterprise users: verify availability in your update channel (stable, beta, dev, or canary), then roll out via group policy, MDM, or equivalent platform. Individual users should allow Chrome to auto-update or manually check Settings > About Google Chrome. Verify successful patching by confirming the browser version number in chrome://version/. Prioritize systems where GPU process compromise is deemed a realistic risk.

Detection guidance

Monitor for Chrome versions older than 149.0.7827.115 across your asset inventory. Endpoint detection and response (EDR) tools may flag suspicious GPU process behavior (e.g., memory introspection, allocation pattern anomalies) as a leading indicator of GPU compromise. Log browser update compliance and flag systems lagging behind the patched version. Detect malicious HTML pages using web content filtering and inspection tools. Note that exploitation leaves no artifact in the GPU process itself once the memory read occurs.

Why prioritize this

This vulnerability ranks as medium priority because successful exploitation requires a multi-stage attack: first compromising the GPU process, then delivering a malicious webpage. Organizations running unpatched Chrome should update as part of routine patch cycles, but this should not preempt patching of critical or high-severity vulnerabilities affecting primary attack paths. Prioritize higher if your environment has evidence of GPU-level exploitation attempts or if your users regularly process highly sensitive data in-browser.

Risk score, explained

The CVSS 5.3 medium score reflects a high-confidence attack (network-accessible, public Chrome), but significant real-world barriers: the attacker must already have GPU process code execution (high attack complexity), and user interaction is required. The impact is confidentiality-only (reading memory), with no availability or integrity risk. The score appropriately de-prioritizes this compared to direct RCE vulnerabilities, but the confidentiality impact of memory exfiltration warrants immediate patching once other critical issues are addressed.

Frequently asked questions