EUVD-2026-35268
GHSA-w669-6jc5-cg7f
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted video file. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's codec subsystem on Linux and ChromeOS (versions prior to 149.0.7827.103) enables remote unauthenticated attackers to exfiltrate sensitive data from other origins by delivering a specially crafted video file to a target user. The root cause is uninitialized memory use (CWE-457) within the codec pipeline, where memory contents from other origin contexts may be exposed during video processing. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as 'none'; however, the network-accessible attack surface and lack of authentication requirement make patching a prudent priority for Linux and ChromeOS deployments.
Technical ContextAI
The vulnerability resides in Google Chrome's codec processing layer, specifically affecting Linux and ChromeOS builds prior to version 149.0.7827.103. CWE-457 (Use of Uninitialized Variable) describes the root cause: a variable or memory buffer in the video codec path is accessed before being properly initialized, potentially exposing residual memory contents to the processing context. In a browser environment, this class of flaw is particularly significant because codec workers can process data across different web origins; uninitialized buffers may contain heap or stack data from prior operations involving cross-origin content, enabling same-process memory disclosure that bypasses the Same-Origin Policy. The Chromium bug tracker reference (issues.chromium.org/issues/515419790) is the authoritative upstream record. The ENISA EUVD tracks this as EUVD-2026-35268. CPE-level scoping from EUVD confirms the affected range as Chrome builds below 149.0.7827.103 on Linux and ChromeOS platforms specifically.
RemediationAI
The primary remediation is to update Google Chrome to version 149.0.7827.103 or later, as confirmed by the vendor advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome's auto-update mechanism should deliver this patch automatically; administrators managing enterprise Linux or ChromeOS fleets should verify deployment via policy or fleet management tooling. For environments where immediate patching is not feasible, a compensating control is to restrict or block access to untrusted video content through proxy-level filtering or browser policy disabling video media types - note this may break legitimate media functionality and is not a substitute for patching. ChromeOS managed device administrators can use the Chrome Browser Cloud Management console to force update to the stable channel. No workaround eliminates the underlying uninitialized memory condition; patching to 149.0.7827.103 is the only confirmed fix.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today