CVE-2026-22166
CWE-416Published: May 1, 2026· Updated: May 6, 2026
Official Description
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the system.
Technical Analysis
CVE-2026-22166 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.
From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-416)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-22166 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts