CVE-2026-9113
published 2026-05-20CVE-2026-9113: Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…
PriorityP419medium4.3CVSS 3.1
AVNACLPRNUIRSUCLINAN
EPSS
0.22%
12.3th percentile
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 148.0.7778.179 | 148.0.7778.179 | |
| chrome | >= 148.0.7778.179 < 148.0.7778.179 | 148.0.7778.179 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
vendor_paloalto·2026-06-10·CVSS 8.8
CVE-2026-8509 [HIGH] PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html CVE Summary CVE-2026-8509 Heap buffer overflow in WebML CVE-2026-8510 Integer overflow in Skia CVE-2026-8511 Use after free in UI CVE-2026-8512 Use after free in FileSystem CVE-2026-8513 Use after free in Input CVE-2026-8514 Use after free in Aura CVE-2026-8515 Use after free
Red Hat
chromium-browser: Out of bounds read in GPU
vendor_redhat·2026-05-19·CVSS 4.3
CVE-2026-9113 [MEDIUM] CWE-125 chromium-browser: Out of bounds read in GPU
chromium-browser: Out of bounds read in GPU
An out of bounds read flaw was found in the GPU component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=489585044
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-9113
vendor_chrome·2026-05-19·CVSS 4.3
CVE-2026-9113 [HIGH] Stable Channel Update for Desktop: CVE-2026-9113
Stable Channel Update for Desktop
CVE-2026-9113: Out of bounds read in GPU. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-04 [N/A][ 495798630 ] High CVE-2026-9114: Use after free in QUIC
Reported by Google on 2026-03-24 [N/A][ 495999481 ] High CVE-2026-9115: Insufficient policy enforcement in Service Worker
Severity: high
GHSA
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
ghsa·2026-06-26
CVE-2026-48979 [HIGH] CWE-444 PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
## Impact
`Psl\H2\ServerConnection` does not validate that the total bytes received in DATA frames match the `content-length` header declared in the HEADERS frame, in violation of RFC 9113 §8.1.1.
A malicious client can:
- Send more DATA bytes than declared, smuggling additional content past application-level size limits.
- Send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly.
The vulnerability is only reachable for consumers using `Psl\H2\ServerConnection` directly to accept untrusted client traffic. The high-level `Psl\HTTP\Server` is in active development and was not yet released at the time of this
GHSA
gun_http2 has an Origin Validation Error vulnerability
ghsa·2026-06-08
CVE-2026-43972 [MEDIUM] CWE-346 gun_http2 has an Origin Validation Error vulnerability
gun_http2 has an Origin Validation Error vulnerability
Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.
In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is
GHSA
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
ghsa·2026-06-08
CVE-2026-44892 [HIGH] CWE-1188 Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
### Summary
The default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`.
### Details
Netty securely limits header sizes for older protocols. In HTTP/1.1, Netty strictly enforces an `8192`-byte limit out-of-the-box via `HttpObjectDecoder`. For HTTP/2, while RFC 9113 specifies that `SETTINGS_MAX_HEADE
GHSA
GHSA-7rqh-fgfv-43q2: Out of bounds read in GPU in Google Chrome on Mac prior to 148
ghsa_unreviewed·2026-05-20
CVE-2026-9113 [MEDIUM] CWE-125 GHSA-7rqh-fgfv-43q2: Out of bounds read in GPU in Google Chrome on Mac prior to 148
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
VulDB
Google Chrome up to 148.0.7778.168 on macOS GPU out-of-bounds
vuldb·2026-05-20·CVSS 4.3
CVE-2026-9113 [MEDIUM] Google Chrome up to 148.0.7778.168 on macOS GPU out-of-bounds
A vulnerability described as problematic has been identified in Google Chrome on macOS. This affects an unknown function of the component GPU. Such manipulation leads to out-of-bounds read.
This vulnerability is uniquely identified as CVE-2026-9113. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43972 gun: Gun: Cross-origin cookie injection leading to session fixation and account takeover.
bugzilla·2026-06-08·CVSS 6.3
CVE-2026-43972 [MEDIUM] CVE-2026-43972 gun: Gun: Cross-origin cookie injection leading to session fixation and account takeover.
CVE-2026-43972 gun: Gun: Cross-origin cookie injection leading to session fixation and account takeover.
Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.
In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a pro
Bugzilla
CVE-2026-9110 CVE-2026-9111 CVE-2026-9112 CVE-2026-9113 CVE-2026-9114 CVE-2026-9115 CVE-2026-9116 CVE-2026-9117 CVE-2026-9118 CVE-2026-9119 CVE-2026-9120 CVE-2026-9121 CVE-2026-9122 CVE-2026-9123 CVE-
bugzilla·2026-05-28·CVSS 4.2
CVE-2026-9110 [MEDIUM] CVE-2026-9110 CVE-2026-9111 CVE-2026-9112 CVE-2026-9113 CVE-2026-9114 CVE-2026-9115 CVE-2026-9116 CVE-2026-9117 CVE-2026-9118 CVE-2026-9119 CVE-2026-9120 CVE-2026-9121 CVE-2026-9122 CVE-2026-9123 CVE-
CVE-2026-9110 CVE-2026-9111 CVE-2026-9112 CVE-2026-9113 CVE-2026-9114 CVE-2026-9115 CVE-2026-9116 CVE-2026-9117 CVE-2026-9118 CVE-2026-9119 CVE-2026-9120 CVE-2026-9121 CVE-2026-9122 CVE-2026-9123 CVE-2026-9124 ... chromium: various flaws [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-9110 CVE-2026-9111 CVE-2026-9112 CVE-2026-9113 CVE-2026-9114 CVE-2026-9115 CVE-2026-9116 CVE-2026-9117 CVE-2026-9118 CVE-2026-9119 CVE-2026-9120 CVE-2026-9121 CVE-2026-9122 CVE-2026-9123 CVE-
bugzilla·2026-05-28·CVSS 4.2
CVE-2026-9110 [MEDIUM] CVE-2026-9110 CVE-2026-9111 CVE-2026-9112 CVE-2026-9113 CVE-2026-9114 CVE-2026-9115 CVE-2026-9116 CVE-2026-9117 CVE-2026-9118 CVE-2026-9119 CVE-2026-9120 CVE-2026-9121 CVE-2026-9122 CVE-2026-9123 CVE-
CVE-2026-9110 CVE-2026-9111 CVE-2026-9112 CVE-2026-9113 CVE-2026-9114 CVE-2026-9115 CVE-2026-9116 CVE-2026-9117 CVE-2026-9118 CVE-2026-9119 CVE-2026-9120 CVE-2026-9121 CVE-2026-9122 CVE-2026-9123 CVE-2026-9124 ... chromium: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-9113 chromium-browser: Out of bounds read in GPU
bugzilla·2026-05-20·CVSS 4.3
CVE-2026-9113 [MEDIUM] CVE-2026-9113 chromium-browser: Out of bounds read in GPU
CVE-2026-9113 chromium-browser: Out of bounds read in GPU
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-42788 bandit: Bandit: Denial of Service via oversized HTTP/2 frames
bugzilla·2026-05-01·CVSS 6.9
CVE-2026-42788 [MEDIUM] CVE-2026-42788 bandit: Bandit: Denial of Service via oversized HTTP/2 frames
CVE-2026-42788 bandit: Bandit: Denial of Service via oversized HTTP/2 frames
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized HTTP/2 frames.
'Elixir.Bandit.HTTP2.Frame':deserialize/2 in lib/bandit/http2/frame.ex checks the SETTINGS_MAX_FRAME_SIZE limit only after pattern-matching payload::binary-size(length), which requires the entire frame body to be present in memory before either the accept or reject clause can fire. A peer that announces a frame length up to the 24-bit maximum (~16 MiB) causes the server to buffer that entire body before the size guard is evaluated, regardless of the max_frame_size negotiated during the HTTP/2 handshake (default 16 KiB per RFC 9113).
An unauthenticated attacke
2026-05-20
Published