CVE-2026-41157: GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.
The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable WebGPU (for example via browser flags or enterprise policy) to prevent untrusted web pages with WebGPU content from being loaded into the GPU GLES render process.
Browser WebGPU = disabled - Configuration
Disable hardware acceleration or configure the browser to use software rendering so the GPU GLES render process and GPU user-space driver are not used.
Browser Hardware acceleration / GPU process = disabled - Compensating control
Use network/web-content filtering (proxy, firewall, or secure web gateway) to block or restrict access to untrusted sites that may host malicious WebGPU content, and restrict which clients can load WebGPU-heavy pages.
- Operational
When vendor security updates or patches for the GPU DDK (CalculateNPOTTwiddleSparsePageMap3D) become available, apply them and restart affected browsers and services. Until patches are available, keep affected systems isolated from untrusted web content.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41157?
CVE-2026-41157 has a critical severity rating of 9.8 on the CVSS scale.
How do I fix CVE-2026-41157?
To fix CVE-2026-41157, update Google Chrome to the latest version as soon as a patch is available.
What are the potential impacts of CVE-2026-41157?
CVE-2026-41157 may lead to memory corruption, browser crashes, and potential exploitation of user data.
Which software is affected by CVE-2026-41157?
CVE-2026-41157 affects the Google Chrome web browser that utilizes GPU drivers.
What is the cause of CVE-2026-41157?
CVE-2026-41157 is caused by an out-of-bounds write vulnerability in the GPU user-space driver due to improper handling of untrusted input.