EUVD-2026-36346
GHSA-5x54-5cg6-5439
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics align with network delivery, required user interaction, and confidentiality-only memory disclosure.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Google Chrome's Video component on ChromeOS exposes process memory to attackers who have already established renderer process compromise. Specifically, an attacker with an existing foothold in the renderer can serve a crafted HTML page to a ChromeOS user and extract potentially sensitive data from memory. No public exploit or CISA KEV listing exists at time of analysis, and EPSS places exploitation probability at 0.03% (11th percentile), indicating low real-world exploitation activity despite the High CVSS confidentiality impact.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) identifies the root cause: the Video subsystem in Chrome on ChromeOS fails to properly validate memory boundaries when processing crafted video content embedded in HTML, allowing reads beyond allocated buffers. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scopes this to the Chrome application layer on ChromeOS, not other platforms. Out-of-bounds reads in browser media pipelines are a well-known attack surface, typically arising from insufficient length or index validation in demuxing or decoding routines. The critical precondition - that the attacker 'had compromised the renderer process' - indicates this vulnerability is designed to be chained: it serves as a post-exploitation primitive for data exfiltration after a renderer sandbox has already been breached via a separate flaw.
RemediationAI
Vendor-released patch: Chrome 149.0.7827.115. ChromeOS users and administrators should ensure Chrome is updated to 149.0.7827.115 or later via Settings > Help > About Google Chrome or through enterprise device management policies (e.g., Google Admin Console for managed ChromeOS fleets). The fix is documented in the stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. Because exploitation first requires a compromised renderer process, organizations that cannot immediately patch should prioritize monitoring for signs of renderer exploitation (anomalous child process behavior) and ensure Chrome's sandbox is enabled (it is on by default). Disabling JavaScript or restricting access to video-embedding sites via enterprise policy would reduce attack surface but carries significant usability trade-offs and is not recommended as a long-term substitute for patching.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today