EUVD-2026-30455
GHSA-xm7r-268r-ww34
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N for network-delivered crafted page; AC:H captures required prior renderer compromise; C:H for sensitive process memory exposure; I:N and A:N confirmed, no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Google Chrome's UI component (versions prior to 148.0.7778.168) enables a remote attacker who has already compromised the renderer process to extract potentially sensitive data from process memory via a crafted HTML page. This is a second-stage exploitation primitive - not an initial access vector - requiring a pre-existing renderer compromise as a hard prerequisite. No public exploit code has been identified, EPSS sits at 0.03% (8th percentile), and SSVC rates exploitation status as none, collectively indicating low near-term exploitation probability despite the High confidentiality impact in the CVSS score.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a memory safety flaw where code reads beyond an allocated buffer boundary, potentially exposing adjacent memory contents. In Chromium's architecture, the UI process and renderer process are intentionally separated by a sandbox boundary; the UI layer handles trusted browser chrome elements while renderer processes handle untrusted web content. This vulnerability resides in Chrome's UI component, meaning a compromised renderer must have already bridged the sandbox or IPC boundary to reach the UI layer before the OOB read can be triggered. The affected product is confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions below 148.0.7778.168. Tags referencing Red Hat and SUSE suggest downstream Linux distribution packages are also in scope for tracking.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.168. Update immediately via Chrome's built-in update mechanism or through the system package manager for Red Hat and SUSE Linux distributions. The authoritative stable channel update advisory is at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Because exploitation requires a pre-existing renderer compromise, organizations that cannot immediately patch should prioritize mitigating renderer-level vulnerabilities - specifically ensuring Chrome's sandbox is fully enabled and not disabled by enterprise policy, as a functioning sandbox significantly raises the bar for the renderer compromise prerequisite. No standalone workaround neutralizes this specific OOB read without patching, since disabling the affected UI feature is not a user-accessible option.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today