CVE-2026-6921
published 2026-04-23CVE-2026-6921: Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file…
PriorityP344high8.3CVSS 3.1
AVNACHPRNUIRSCCHIHAH
EPSS
0.19%
8.5th percentile
Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 147.0.7727.116 | 147.0.7727.116 | |
| chrome | >= 147.0.7727.117 < 147.0.7727.117 | 147.0.7727.117 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vxp2-rhxg-cr83: Race in GPU in Google Chrome on Windows prior to 147
ghsa_unreviewed·2026-04-23
CVE-2026-6921 [MEDIUM] CWE-362 GHSA-vxp2-rhxg-cr83: Race in GPU in Google Chrome on Windows prior to 147
Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
VulDB
Google Chrome up to 147.0.7727.101 on Windows GPU race condition
vuldb·2026-04-23·CVSS 8.3
CVE-2026-6921 [HIGH] Google Chrome up to 147.0.7727.101 on Windows GPU race condition
A vulnerability described as problematic has been identified in Google Chrome on Windows. The impacted element is an unknown function of the component GPU. Such manipulation leads to race condition.
This vulnerability is listed as CVE-2026-6921. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
Palo Alto
PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026)
vendor_paloalto·2026-05-13·CVSS 8.8
CVE-2026-4439 [HIGH] PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026)
PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html CVE Summary CVE-2026-4439 Out of bounds memory access in WebGL CVE-2026-4440 Out of bounds read and write in WebGL CVE-2026-4441 Use after free in Base CVE-2026-4442 Heap buffer overflow in
Red Hat
Google Chrome: Chromium: chromium-browser: Race in GPU
vendor_redhat·2026-04-23·CVSS 8.3
CVE-2026-6921 [HIGH] CWE-368 Google Chrome: Chromium: chromium-browser: Race in GPU
Google Chrome: Chromium: chromium-browser: Race in GPU
A race flaw was found in the GPU component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=493315759
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Chrome
Stable Channel Update for Desktop: CVE-2026-6919
vendor_chrome·2026-04-22·CVSS 9.6
CVE-2026-6919 [HIGH] Stable Channel Update for Desktop: CVE-2026-6919
Stable Channel Update for Desktop
CVE-2026-6919: Use after free in DevTools. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-18 [TBD][ 499891888 ] High CVE-2026-6920: Out of bounds read in GPU
Reported by tatiwari of Microsoft on 2026-04-06 [TBD][ 493315759 ] Medium CVE-2026-6921: Race in GPU
Severity: high
No detection rules found.
No public exploits indexed.
2026-04-23
Published