What’s Vulnerable › Vulnerabilities

CVE-2019-16508

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-01 · updated 2026-06-17
• Weakness: CWE-190

Description

The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers to trigger an Integer Overflow and gain privileges via a malicious application. This occurs because of intentional access for the GPU process to /dev/dri/card1 and the PowerVR ioctl handler, as demonstrated by PVRSRVBridgeSyncPrimOpCreate.

Affected products

• Google ChromeOS: before r74-11895.b; from r75 before r75.12105.b; from r76 before r76.12208.0.0 — fixed in r74-11895.b, r75.12105.b, r76.12208.0.0

How to fix

Upgrade to a fixed version: Google ChromeOS r74-11895.b, r75.12105.b, r76.12208.0.0. Check the vendor advisory for mitigations.

References

• https://bugs.chromium.org/p/chromium/issues/detail?id=960106
• https://bugs.chromium.org/p/chromium/issues/detail?id=960106

Get alerted when CVE-2019-16508 or the next vulnerability affects your stack