Including an advertiser on a webpage.

This highlights why we shouldn't let browsers (google) keep expanding their reach outside of the historical sandbox. It's almost like all the in-browser Java and Flash problems being repeated. They're creating security problems more than helping legitimate developers. WebGL was fine. Websockets were fine. WebGPU and the recently proposed arbitrary socket API are jumping the shark. Raw GPU access and TCP/UDP access are simply bad ideas from inexperienced people and need to be shut down. If you truly need that stuff I think the solution is to step up your game and make native applications.

This to me is the big risk here. A worm hidden in a game mod or something.

I can see it staying in the wild for a long time too. How many of the people that are playing on these cards, or crypto mining, or doing LLM work, are really going to even find out about these vulnerabilities and update the drivers?

The attack surface from a browser is tiny. All you can do is call into ANGLE or Dawn through documented, well-defined and well-tested APIs. Or use things like canvas and CSS animations, I suppose. Browser vendors care a lot about security, so they try to make sure these libraries are solid and you can't interact with the GPU in any other way.

Native applications talk directly to the GPU's kernel-mode driver. The intended flow is that you call into the vendor's user-mode drivers - which are dynamic libraries in your application's address space - and they generate commands and execute ioctls on your application's behalf. The interface between these libraries and the KMD is usually undocumented, ill-defined and poorly tested. GPU vendors don't tend to care about security, so if the KMD doesn't properly validate some inputs, well, that issue can persist a long time. And if there's any bit of control stream that lets you tell the GPU to copy stuff between memory you own and memory you don't... I guess you get a very long security bulletin.

The point is, webpages have access to a much smaller attack surface than native applications. It's unlikely anything in this bulletin is exploitable through a browser.

This is why Qubes OS, which runs everything in isolated VMs, doesn't allow them to use the GPU. My daily driver, can't recommend it enough if you care about security.

A cursory search suggests such plugins aren't sandboxed and run with the same privileges as the main program itself, so I'd definitely be suspicious of any plugin.

No, Windows Update's Nvidia driver set is usually years out of date and rarely gets updated. It exists as an emergency fallback and doesn't push out regular updates.

On Windows you have to either download the driver updates manually, or install that GeForce Experience thing that keeps them up to date for you.

The fine print on the security notice page says that there is a 565.92 version that some OEMs are pushing out themselves.

I get that there is a different release cadence, but it’s simply not acceptable to do business as normal surrounding security releases. The driver page should either have that 656.92 available or disable the download link for the stable channel with a note on when they expect it to be available again.

At the very least, some product manager should be fired. This is a legal liability, and no amount of click-wrap disclaimers will protect them if someone gets owned because of this negligence.

The studio driver also opens up some functionality that the game driver does not.