EUVD-2026-35204
GHSA-jmpj-8p4w-j5rq
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Integer overflow in libyuv allows a renderer-compromised attacker to read sensitive process memory in Google Chrome prior to 149.0.7827.103. This is a chained, post-exploitation vulnerability: the attacker must first control the Chrome renderer process (via a separate exploit), then serve a crafted HTML page that triggers the libyuv integer overflow to extract memory contents - making this a privilege escalation and data exfiltration primitive within a broader attack chain. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
libyuv is Google's open-source library for YUV/RGB color space conversion and image scaling, embedded directly in Chromium's rendering pipeline for video and image processing. An integer overflow (arithmetic wraparound on a bounded integer type) in libyuv can corrupt internal buffer length or index calculations, causing subsequent memory reads to fall outside intended boundaries - leaking adjacent heap or stack contents. The assigned CWE is CWE-472 (External Control of Assumed-Immutable Web Parameter), which is notably inconsistent with an integer overflow root cause; CWE-190 (Integer Overflow or Wraparound) would be the canonical classification. This discrepancy should be verified against the Chromium issue tracker (issues.chromium.org/issues/516986556). The affected product range per EUVD is Chrome versions up to but not including 149.0.7827.103.
RemediationAI
Update Google Chrome to version 149.0.7827.103 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome's auto-update mechanism should apply this automatically for most users; administrators managing enterprise fleets should push the update via policy and verify deployment. Because this vulnerability requires renderer compromise as a prerequisite, organizations that enforce Chrome's --site-isolation-trial-opt-out=false or have Site Isolation fully enabled gain a meaningful compensating control by limiting renderer process access to sensitive cross-origin memory - though this does not eliminate the vulnerability. Disabling JavaScript execution entirely would prevent the triggering HTML page from loading, but carries severe usability trade-offs. Restricting access to untrusted web content via proxy or allowlist policies reduces exposure to the crafted HTML delivery vector.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today