Google Chrome CVE-2026-11678

Exploitation requires two distinct conditions to be satisfied simultaneously. First, the attacker must have already compromised the Chrome renderer process via a separate, independent vulnerability - this is the primary limiting factor and a significant operational prerequisite not captured by the PR:N CVSS rating. Second, the victim must visit or be directed to a crafted HTML page (UI:R), which serves content processed by libyuv (e.g., images or video encoded in YUV format). The overflow does not provide sandbox escape on its own; impact is scoped to memory readable by the renderer process (S:U). No specific non-default Chrome configuration is required once renderer access is established. Exploitation is limited to information disclosure (C:H) with no write or denial-of-service primitive (I:N/A:N). The high attack complexity (AC:H) rating reflects the chained-exploit requirement.

Despite the Chromium 'High' severity label, the NVD CVSS score of 5.3 (Medium) reflects significant real-world mitigating factors. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N highlights the tension: AC:H indicates high attack complexity because successful exploitation requires a pre-compromised renderer process - a substantial, independent prerequisite that itself demands a separate browser exploit. The C:H (high confidentiality impact) is meaningful only if the attacker can already execute code in the renderer. There is no integrity or availability impact (I:N/A:N), and the unchanged scope (S:U) means the overflow does not directly break out of the sandbox. No EPSS data was provided, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. PR:N in the CVSS vector is consistent with no Chrome-level privilege requirement once renderer access is assumed, but this masks the real operational bar. Overall, this is a secondary-stage memory disclosure tool in a multi-exploit chain, not a standalone critical entry point - but it is high-value for attackers who have already achieved renderer compromise and need to escalate or leak credentials/tokens from memory.

An attacker who has already achieved code execution in a Chrome renderer process (through a separate, unpatched browser vulnerability) crafts a malicious HTML page containing specially constructed image or video data designed to trigger the libyuv integer overflow. When the compromised renderer processes this content, the overflow corrupts a buffer length calculation in libyuv, causing a subsequent read operation to return bytes from adjacent process memory - potentially exposing heap-resident secrets such as authentication tokens, decrypted content, or browser session data. No public proof-of-concept code has been identified at time of analysis, which raises the operational bar for exploitation.