EUVD-2026-40544
GHSA-cqw3-g77v-4rgh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted video requiring active user interaction (UI:R); no attacker privileges needed; C:H reflects renderer memory exposure; I:N and A:N as the flaw is read-only and no crash is described.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in Chrome's bundled FFmpeg video decoding component (all versions prior to 150.0.7871.47) allows a remote attacker to leak renderer process memory contents via a crafted video file. The CVSS vector confirms network reachability with no required privileges (PR:N) but mandates user interaction (UI:R), meaning the victim must process the malicious video. SSVC assessment rates exploitation as none and the attack non-automatable, and no public exploit has been identified at time of analysis; Google has released a patched build at 150.0.7871.47.
Technical ContextAI
FFmpeg is an open-source multimedia framework bundled within Chrome to handle video and audio decoding across dozens of codecs. CWE-125 (Out-of-Bounds Read) identifies the root cause: insufficient boundary validation during video stream parsing causes the decoder to read beyond an allocated buffer, exposing adjacent memory in the renderer process. This class of defect typically arises from incorrect index arithmetic or missing length checks inside codec-specific parsing loops - common in complex, C-written media libraries handling variable-length encoded data. The CVSS scope metric S:U indicates the exploit does not escape Chrome's renderer sandbox, so impact is confined to the renderer process address space rather than the broader OS. The Chromium issue tracker reference (https://issues.chromium.org/issues/507090179) is the upstream disclosure point, reported through the standard chrome-cve-admin@google.com channel.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 150.0.7871.47 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; this is a vendor-released patch and represents the complete fix. Most desktop Chrome installations update automatically - verify via chrome://settings/help. Enterprise environments using managed Chrome deployment (Google Admin Console or third-party MDM) should push the 150.0.7871.47 build immediately. If immediate patching is blocked, partial compensating controls include configuring web proxy or DNS filtering to block untrusted media-hosting domains, enforcing enterprise policy to disable video autoplay (AutoplayAllowed=false), and restricting users from opening downloaded video files in Chrome directly; note these controls add workflow friction and do not eliminate the attack surface from visited web pages. Chrome's renderer sandbox provides containment but is not a substitute for patching.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today