CVE-2026-65587 Details
Description
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an intended memory offset. Writing outside the bounds of allocated memory can corrupt adjacent memory, crash the process, or cause undefined behaviour.
A vulnerability exists in the Imagination Technologies GPU user-space driver, specifically within the WebGPU shader compilation process. This vulnerability allows for an out-of-bounds write, which can lead to memory corruption and potentially cause a crash in the browser or GPU process. The issue arises when a web page loads unusual WebGPU content or shader code, triggering the GPU compiler to mishandle the data. The memory corruption can disrupt adjacent memory areas, causing undefined behavior or crashing the process.
The DDK compiler library has been updated to safely handle unusual GPU shader code, preventing disruptions during shader compilation. Users should ensure they are using a version of the Imagination Technologies GPU driver that includes this update.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imaginationtech.com/gpu-driver-vulnerabilities/ | imaginationtech | BundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | imaginationtech |
Affected Products
| Product | Versions |
|---|---|
| Chromium | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | imaginationtech |