EUVD-2026-36340
GHSA-pr7p-m797-x6pj
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via crafted page (AV:N, UI:R); AC:H because exploitation requires a chained prior renderer compromise and reliable heap grooming; PR:N as no Chrome auth is needed; scope change and full CIA on sandbox escape.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a heap buffer overflow in the Codecs component triggered by a crafted HTML page. Google rates the underlying issue as High severity and a vendor patch is available, but no public exploit is identified at time of analysis and the bug is not listed in CISA KEV. Exploitation is conditional on chaining with a prior renderer compromise, which raises real-world complexity.
Technical ContextAI
The flaw lives in Chrome's Codecs subsystem, which handles decoding of media and image streams inside the renderer/process boundary, and is classified as CWE-787 (out-of-bounds write) manifesting as a heap buffer overflow. Affected builds match CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Linux and ChromeOS specifically; Windows and macOS are not called out by Google in this advisory. Because codec parsing in Chrome runs with access to IPC interfaces brokered by the browser process, an out-of-bounds write here can be leveraged to corrupt structures used by sandbox-mediated calls and pivot privileges from the sandboxed renderer up to the broker, which is the canonical Chromium sandbox-escape pattern.
RemediationAI
Vendor-released patch: update Google Chrome on Linux and ChromeOS to 149.0.7827.115 or later as described in the Stable Channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html, and on managed ChromeOS fleets ensure devices have rebooted to apply the platform update. For environments that cannot patch immediately, compensating controls include enforcing Chrome's Site Isolation and Strict Site Isolation policies (already default but worth verifying via enterprise policy) to make renderer compromise harder to weaponize, restricting browsing of untrusted content via URL allowlists or a separate browsing profile, and disabling media autoplay so that codec parsing of attacker-controlled streams requires explicit user action - the trade-off is reduced usability for video-heavy internal apps. Disabling hardware/software video decoding entirely is not recommended as a workaround because it breaks legitimate media playback without removing the underlying parsing path.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today