Google Chrome CVE-2026-13018

Requires the victim to load attacker-controlled crafted video content in a Google Chrome desktop build prior to 147.0.7727.55 (UI:R - user interaction is mandatory). Exploitation is limited by: the need for user interaction (no drive-by without media load), Chrome's sandbox and memory-safety mitigations, the low technical impact (partial confidentiality only, no code execution or availability loss), and the fact that it is not automatable at scale (SSVC Automatable: no). No authentication is required (PR:N), but there is no impact on default configurations beyond a bounded memory over-read.

This is a genuinely low-priority issue and the multiple signals agree, which is unusual and reassuring. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) matches Chromium's own 'Low' severity rating: the only measurable impact is a partial confidentiality leak (C:L), with no integrity or availability effect. CISA's SSVC framework independently supports low urgency - Exploitation: none, Automatable: no, Technical Impact: partial - meaning no observed exploitation and no way to reliably automate mass exploitation (each attack needs a victim to load a crafted video). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept identified at time of analysis. The one caveat: the description says 'out of bounds memory access,' which is ambiguous between read and write, but the vendor CVSS scores I:N/A:N and C:L, indicating this is effectively an out-of-bounds READ / information disclosure rather than a memory-corruption/RCE primitive - the 'Information Disclosure' tag is consistent with this. No signals conflict; the only genuinely unknown factor is the precise nature of the leaked memory contents, which the sparse Chromium issue tracker entry does not disclose publicly.

An attacker hosts or serves a specially crafted video file and lures a victim into visiting a web page (or opening media) in a vulnerable Chrome build before 147.0.7727.55. When Chrome's codec parses the malformed video, it reads out of bounds, potentially exposing small amounts of adjacent process memory to the attacker-influenced context. No public exploit code has been identified, and the attack requires the user to load the malicious content (UI:R).