EUVD-2026-27970Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in WebCodecs video processing in Google Chrome versions prior to 148.0.7778.96 allows remote attackers to leak sensitive memory contents via a crafted video file. The vulnerability requires user interaction to open a malicious video, but affects all users regardless of authentication. Chrome 148.0.7778.96 and later versions patch this information disclosure vulnerability, which could expose cryptographic keys, session tokens, or other sensitive data resident in adjacent memory.
Technical ContextAI
The vulnerability exists in WebCodecs, Chrome's native video encoding and decoding API. CWE-125 (Out-of-bounds Read) describes reading memory beyond allocated buffer boundaries without proper bounds checking. When processing crafted video files, the WebCodecs decoder fails to validate the size of read operations, allowing an attacker to read adjacent heap or stack memory. This affects the built-in Chromium video codec implementation across all platforms where Chrome runs, as identified by the generic CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.
RemediationAI
Users should immediately upgrade to Chrome 148.0.7778.96 or later, available via the official Chrome auto-update mechanism (Settings → About Chrome on desktop, or app store updates on mobile platforms). Google's stable channel update, published May 2026 per the Chrome Releases blog, includes the fix for this vulnerability. Organizations using Chrome for Business should verify deployment of version 148.0.7778.96 or later across managed devices using their device management console (Google Admin Console, Intune, or equivalent). No workarounds short of disabling HTML5 video playback are available; the vulnerability is triggered at the codec level whenever a crafted video file is processed. As a temporary compensating control pending updates, users and administrators may block access to untrusted video sources or disable automatic video autoplay in HTML content, though this significantly impacts legitimate use.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today