EUVD-2026-34415
GHSA-rg7g-8w6w-cjj6
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to break out of the renderer process sandbox by delivering a crafted video file processed by the browser's codec implementation. The CVSS 9.6 score reflects a scope-changing impact across confidentiality, integrity, and availability, though exploitation requires user interaction such as visiting a malicious page. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Assess Chrome deployment scope and identify high-risk user populations (executives, developers, researchers). 7 days: Deploy Chrome version 149.0.7827.53 or later across all endpoints using configuration management systems and verify coverage reaches at least 80% of installed base. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addIn
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to trigge
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to exploit a use-after-free cond
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised t
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to break
Share
External POC / Exploit Code
Leaving vuln.today