EUVD-2026-50597
GHSA-hfr7-894p-qm78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious media
-
DeliveryDeliver crafted video file
-
ExploitTrigger integer overflow in codec parser
-
ExecutionCorrupt memory in media pipeline
-
PersistEscape renderer sandbox
-
ImpactExecute code at higher privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to load an attacker-crafted video file in a vulnerable Chrome build (before 151.0.7922.72) so that the malformed stream reaches the Codecs parser - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and the attack works remotely over the network (AV:N) against default configurations, but it is not a no-interaction drive-by: the user must render the malicious media. Limiting factors are the need for that interaction, a still-vulnerable version, and reliably chaining the integer overflow into a working sandbox escape, which the description frames as only 'potentially' achievable. |
| Impact | The signals conflict and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) scores 9.6 Critical, driven by network reach, low complexity, no privileges, and a scope change from the sandbox escape - but it requires user interaction (loading a crafted video). Against that, EPSS is only 0.17% (6th percentile), the CVE is NOT on CISA KEV, and no public POC is referenced, indicating no observed or imminent mass exploitation. Chromium's internal 'Medium' severity rating further tempers the picture and conflicts with the 9.6 figure - the NVD-style score appears to weight the theoretical sandbox-escape scope change heavily, while the vendor views practical impact as more constrained. Net assessment: a real but not emergency priority - patch on Chrome's normal auto-update cadence rather than treating it as an actively exploited zero-day. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker hosts a web page or delivers a file containing a specially crafted video that overflows an integer during codec parsing; when the victim visits the page or opens the media in Chrome, the corruption is used to attempt escape from the renderer sandbox and run code with broader privileges. The attack is remote and low-complexity but hinges on user interaction (loading the media), and no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most installs will receive this automatically, so verify auto-update is enabled and force a relaunch to apply it. In managed fleets, push the pinned version via enterprise policy and confirm the effective version in chrome://settings/help. As an interim compensating control before rollout, reduce exposure to untrusted media by discouraging users from opening video files or pages from unknown sources and by using content filtering/proxy controls to limit attacker-controlled media delivery - these lower the odds a user triggers the required interaction but do not fully close the flaw and can hinder legitimate media use, so they are stopgaps only until the update is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's Codecs component, the media pipeline responsible for demuxing and decoding video streams (e.g., H.264/VP9/AV1 containers). The root cause is classified as CWE-20 (Improper Input Validation): a specific length, dimension, or offset field in a crafted video file is not validated before arithmetic, producing an integer overflow that yields an undersized allocation or out-of-bounds index - the accompanying 'Buffer Overflow' tag reflects the memory-corruption consequence. Because media decoding can occur in a lower-privileged process, a corruption primitive here is leveraged toward a sandbox escape, moving code execution beyond the renderer's confinement. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application across versions below the fixed build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote and unauthenticated but requires the victim to load crafted media (UI:R) and reliable sandbox escape is nontrivial (AC:H); sandbox escape justifies scope change (S:C).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome desktop contains a sandbox escape vulnerability (CVE-2026-17848) in media codec handling affecting versions prior to 151.0.7922.72 that could enable remote code execution when users open maliciously crafted video files. While the EPSS score of 0.2% and lack of public exploits indicate low near-term exploitation probability, the attack vector requires only user interaction, making it a meaningful risk for endpoint compromise via phishing or embedded malicious content. Patching is critical to eliminate this code execution pathway and prevent potential attacker persistence and lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB