EUVD-2026-35240
GHSA-p626-pw8w-29p4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure user to crafted page
-
DeliveryTrigger prior renderer RCE
-
ExploitDeliver malicious media to libyuv
-
InstallOverflow integer in size calculation
-
C2Corrupt memory across sandbox boundary
-
ExecuteExecute code in privileged Chrome process
-
ImpactPersist or pivot to host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Server-side parameter enforcement
|
| Exploitation Conditions | Exploitation requires the attacker to have already compromised Chrome's renderer process - this bug is a sandbox-escape primitive, not a primary RCE - and the target user must visit (UI:R) a crafted HTML page that delivers attacker-controlled inputs to libyuv conversion routines. No Chrome authentication is needed (PR:N), but exploitation is limited to Chrome (and Chromium-derived browsers embedding the same libyuv revision) on versions prior to 149.0.7827.103, and the AC:H rating reflects that reliable triggering of the integer overflow likely depends on heap state and codec/conversion paths that are not trivially reachable without a prior renderer foothold. |
| Impact | The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) correctly reflects that the bug is reachable over the network, requires high attack complexity, requires user interaction (visiting a page), and crosses a scope boundary (the sandbox) when exploited - all hallmarks of a sandbox-escape primitive that is only useful as the second stage of an exploit chain. EPSS is very low at 0.03% (11th percentile) and the bug is not in CISA KEV, with no public exploit identified at time of analysis, so opportunistic mass exploitation is unlikely; however, Chrome n-day chains are routinely weaponized by commercial spyware vendors and targeted threat actors once details land, so prompt patching is warranted despite the low EPSS. Note a data tension worth flagging: the assigned CWE-472 does not match the 'integer overflow / buffer overflow' wording in the description and Google's tags - the CWE appears miscategorized and the true root cause is an integer overflow leading to a memory-safety violation in libyuv. |
| Exploit ScenarioDerived | An attacker lures a target to a malicious or compromised website that first triggers a separate renderer-process vulnerability to achieve code execution inside the sandboxed renderer, then serves crafted image or video data that drives libyuv into the integer overflow, corrupting memory at a sandbox boundary and pivoting to code execution in a more privileged Chrome process. Because no public exploit has been identified and attack complexity is rated High, this is most plausible as the second stage of a targeted exploit chain rather than commodity drive-by malware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Sandbox escape in Google Chrome versions prior to 149.0.7827.103 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via an integer overflow in the libyuv image conversion library. Exploitation requires user interaction with a crafted HTML page and a chained renderer compromise, but Google rated the underlying issue Critical because a successful chain yields code execution outside Chrome's sandbox. There is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.03%.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 - update Chrome to 149.0.7827.103 or later via the stable channel and restart the browser to apply, as described at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html (tracking issue https://issues.chromium.org/issues/517339758). Administrators managing Chromium-derived browsers should monitor their vendor's advisories and roll the corresponding libyuv update once available. As compensating controls until patching, enforce auto-update via enterprise policy (ChromeEnterprise 'RelaunchNotification' / 'RelaunchNotificationPeriod') to shorten the exposure window, and consider tightening site isolation and disabling unnecessary media/codec features in high-risk environments - note that disabling media codecs will break legitimate video and image-heavy sites and is not a substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libyuv is an open-source YUV scaling and conversion library used by Chrome (and many media pipelines) to handle image and video color-space transforms; it is invoked from the renderer when decoding or transforming visual content. The flaw is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter) but the description and Google's 'Buffer Overflow' tagging point to an integer overflow in libyuv's size or stride calculations that, when crafted inputs are supplied, leads to an undersized allocation and subsequent out-of-bounds write. Because libyuv code paths are reachable from the renderer process, an attacker who already controls the renderer (typically via a prior renderer RCE) can drive the overflow into adjacent process memory or shared buffers used during cross-process media handling, providing a route to escape Chrome's site-isolation sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome versions before 149.0.7827.103 contain a sandbox escape vulnerability that could allow an attacker with an already-compromised browser renderer process to execute code outside the sandbox and potentially gain unrestricted system access. While no public exploit code exists currently and the attack requires a complex exploitation chain including prior browser compromise, the severity and ubiquity of Chrome across enterprise environments warrant immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB