EUVD-2026-30473
GHSA-8h23-fq5j-c3x6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
OOB write from integer overflow realistically causes process instability (A:L); all other metrics match vendor assessment; no confidentiality impact demonstrated.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds memory write in Google Chrome's Internationalization component on Windows allows remote unauthenticated attackers to corrupt process memory by luring a user to a crafted HTML page that triggers an integer overflow, affecting all Chrome versions prior to 148.0.7778.168. Google has rated this High severity internally, though the NVD CVSS scores it 4.3 Medium, reflecting a limited integrity-only impact in the current analysis. No public exploit has been identified at time of analysis; EPSS probability is negligible at 0.03% (7th percentile) and CISA SSVC classifies exploitation as none.
Technical ContextAI
The vulnerability originates in Chrome's Internationalization (i18n) subsystem - the component responsible for locale-aware string handling, character encoding conversion, and Unicode normalization on Windows. An integer overflow in size or offset calculations within this subsystem can produce an undersized buffer allocation, and subsequent writes to that buffer exceed its bounds (out-of-bounds write), corrupting adjacent heap memory. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 148.0.7778.168 on Windows. Notably, the assigned CWE-472 ('External Control of Assumed-Immutable Web Parameter') appears to be a misclassification for this vulnerability; the description clearly describes an integer overflow leading to memory corruption, which aligns with CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write) - security teams should treat the memory corruption framing as authoritative and not rely on the CWE tag for triage logic.
RemediationAI
Update Google Chrome to version 148.0.7778.168 or later on all Windows systems; this is the only confirmed fix, documented in the stable channel release advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's built-in auto-update mechanism will apply this silently for consumer installations; enterprise administrators using Chrome Browser Cloud Management or Group Policy should verify managed devices have received the update and force a policy push if needed. As a compensating control prior to patching - noting that it significantly limits browser utility - organizations may restrict access to untrusted external URLs via proxy allowlist policies or enforce Chrome's Enhanced Safe Browsing mode, which reduces but does not eliminate exposure to crafted pages. No configuration-level workaround exists that disables the i18n subsystem without breaking core browser functionality.
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today