Chromium: CVE-2026-16424 Use after free in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-64421

Name of the Vulnerable Software and Affected Versions GPU DDK affected versions not specified Description An integer overflow occurs during the calculation of physical offsets for sparse PMRs Partial Memory Regions within the PMRLogicalOffsetToPhysicalOffset function. For PMRs larger than 4 GB,...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, writing the GPU information in Google Chrome allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in GPUs in Google Chrome before version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The use of after-free in GPUs in Google Chrome before version 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, reading data from the GPU in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.168, using free after in the GPU in Google Chrome allowed a remote attacker who had compromised the renderer process to perform an out-of-bounds memory write through a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-16424

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-54060 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, text-generation-inference, mlflow, label-studio, tensorflow-gpu-jupyter, open-webui, lmcache-cuda-12.8, openstack-horizon-2026.1-fips, openstack-horizon-2025.2-fips, superset, openstack-horizon-2026.1, openstack-horizon-2025.2,...

CVE-2026-59200 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, text-generation-inference, mlflow, label-studio, tensorflow-gpu-jupyter, open-webui, lmcache-cuda-12.8, openstack-horizon-2026.1-fips, openstack-horizon-2025.2-fips, superset, openstack-horizon-2026.1, openstack-horizon-2025.2,...

CVE-2026-55798 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, text-generation-inference, mlflow, label-studio, tensorflow-gpu-jupyter, open-webui, lmcache-cuda-12.8, openstack-horizon-2026.1-fips, openstack-horizon-2025.2-fips, superset, openstack-horizon-2026.1, openstack-horizon-2025.2,...

CVE-2026-59199 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, text-generation-inference, mlflow, label-studio, tensorflow-gpu-jupyter, open-webui, lmcache-cuda-12.8, openstack-horizon-2026.1-fips, openstack-horizon-2025.2-fips, superset, openstack-horizon-2026.1, openstack-horizon-2025.2,...

GHSA-62P4-GMF7-7G93 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, text-generation-inference, mlflow, label-studio, tensorflow-gpu-jupyter, open-webui, lmcache-cuda-12.8, openstack-horizon-2026.1-fips, openstack-horizon-2025.2-fips, superset, openstack-horizon-2026.1, openstack-horizon-2025.2,...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the decodesliceunittiles process. An attacker can cause a heap buffer over-read by supplying a malformed PPS with tile geometry inconsistent with the SPS, leading to out-of-bounds memory access during decoding...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the decodesliceunitWPP function when decoding a WPP HEVC slice. An attacker can cause a read past the end of an allocated vector by crafting PPS/SPS headers so that the computed ctbAddrRS value exceeds the size of...

CVE-2026-16424

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-16424

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-16424

A use after free vulnerability in the GPU component of Google Chrome on Android (prior to version 150.0.7871.182) allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This vulnerability is also present in Micros...

CVE-2026-45382

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...

CVE-2026-45383 libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...