Web

CVE-2026-125348

Chrome GPU out-of-bounds write enabling remote code execution via crafted HTML.

Major vulnerability. Google Chrome is ubiquitous; an RCE via GPU sandbox escape can affect many users and enterprises and warrants broad IT notification.

CVSS: 8.8Highscored by CISA
Exploited in the wild: Not knownnot in CISA KEV as of our last sync
EPSS: No score yet
Fix: Patch availablesee the advisories in the references
Published: 10 Nov 2026analysed here 12 Nov 2026

Summary

Impact

Remote code execution outside Chrome sandbox via a GPU OOB write from crafted HTML, allowing arbitrary code on host.

Triage

Attack surface: Server-side
Exploitable: At runtime
Attack vector: network
Weakness: CWE-787 Out-of-Bounds Write
Can a WAF block it?: No. See why

The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.

Affected products

Product	Affected versions	Vendor says fixed in
Google Chrome	< 157.0.8103.50Vendor says fixed in: not stated	Not stated by the vendor

As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.

Products named in our analysis

Google Chrome < 157.0.8103.50 (Desktop)
Chromium-based browsers before same update

Fix and mitigation

Action required

Immediate action required

WAF and other mitigations

Can a WAF block it? No. This is an out-of-bounds write, a memory-corruption bug. Generic WAF rules do not recognise the input that triggers it; only a rule written for this specific CVE can, and only if the triggering request has a recognisable shape.

Also consider: patch

Based on the weakness type only; no CVE-specific evidence yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.

Remediation steps (AI-written)

Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.

Exploitation evidence

CISA KEV catalog: Not listed as of our last sync.
Public exploit code: None on record in Exploit-DB, Metasploit, Nuclei templates or PoC-in-GitHub.
CISA SSVC: exploitation none, automatable no, technical impact totalAssessed by CISA 10 Nov 2026 (SSVC 2.0.3). Exploitation is none, poc (public proof of concept) or active.

Timeline

10 Nov 2026CISA SSVC assessment: exploitation none
10 Nov 2026Published1 day later
11 Nov 2026CVE record last updatedsame day later
12 Nov 2026Analysed by vulneraibility.com1 day later

Common questions

Is CVE-2026-125348 being exploited?

Not confirmed. CVE-2026-125348 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.

How severe is CVE-2026-125348?

CVE-2026-125348 is rated High with a CVSS score of 8.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.

Is there a patch for CVE-2026-125348?

Yes. A fix has been recorded for CVE-2026-125348. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.

What does CVE-2026-125348 affect?

CVE-2026-125348 affects Google Chrome < 157.0.8103.50 (Desktop), Chromium-based browsers before same update. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.

What should I do about CVE-2026-125348?

Update Chrome to 157.0.8103.50 or later immediately; restrict untrusted HTML and monitor endpoints.

Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.

References

NVD CVE.org CVE Details Source

2 references in the CVE record, grouped by the tags the record gives them.

Where the data on this page comes from

CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
NVD: CVSS and CPE data
CISA Vulnrichment (ADP): SSVC decision points
FIRST EPSS: exploit probability and percentile

Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.

Similar CVEs

Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.