CVE-2026-74915
Received Received - Intake

WebGPU Content Triggers GPU GLES Memory Corruption

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: imaginationtech

Description
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-74915
EUVD
EUVD-2026-113490

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-823 The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a web page with unusual WebGPU content that triggers an out-of-bounds (OOB) read or write crash in the GPU GLES user-space shared library. On systems where the graphics process runs with system privileges, this flaw could allow attackers to execute further exploits on the device.

Detection Guidance

This vulnerability involves a web page with unusual WebGPU content triggering an out-of-bounds read/write in the GPU GLES library. Detection requires monitoring GPU processes and memory access patterns. Check for crashes in GPU-related processes or logs indicating OOB errors. Use system monitoring tools like 'dmesg' or 'journalctl' for GPU-related crashes. Inspect browser or GPU process logs for WebGPU-related errors.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain control over your device by crashing the GPU process and executing malicious code, especially if the graphics process has high system privileges. This may lead to unauthorized access, data theft, or system compromise.

Mitigation Strategies

Update or patch the GPU GLES user-space shared library to the latest version provided by Imagination Technologies. Disable WebGPU content rendering if not required. Restrict system privileges for graphics workload processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart