EUVD-2026-30389
GHSA-2mp2-jw3g-m6fw
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered malicious media needs no auth (PR:N) but requires the victim to open it (UI:R) and a hard-to-reliably-trigger overflow (AC:H); sandbox escape changes scope (S:C) with full impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome on Windows (versions prior to 148.0.7778.168) can be triggered by an integer overflow in the codecs component when the browser processes a crafted video file, allowing a remote attacker to potentially break out of the renderer sandbox. Chromium rates the security severity as Medium; the assigned CVSS is 8.3 due to high complexity but scope change and full CIA impact. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC lists exploitation status as none, indicating no observed attacks.
Technical ContextAI
The flaw resides in Chrome's media codec layer, which decodes container and stream data from video files. An integer overflow (arithmetic on width/height, frame counts, or buffer-size calculations wrapping past their type limit) leads to undersized allocations or out-of-bounds memory operations during decode. Although the CWE is tagged as CWE-472 (External Control of Assumed-Immutable Web Parameter), the description and 'Buffer Overflow' tag indicate the true root cause is an integer overflow in the CWE-190 class, so the CWE mapping appears inconsistent with the description. Because media parsing and the escape path interact with the sandbox boundary, a successful overflow can corrupt memory in a way that helps a compromised or crafted decode context cross the renderer sandbox (reflected in the CVSS S:C scope change). Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically the Windows build prior to 148.0.7778.168.
RemediationAI
Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on Windows via the Stable channel (relaunch the browser to apply the pending update), per https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chromium-based browsers (Edge, and Red Hat/Suse-packaged builds) should be updated to the version that incorporates this fix once published by those vendors. As an interim compensating control before patching, restrict handling of untrusted video content - for example, avoid opening untrusted video files or links in Chrome and consider policy-based blocking of autoplay/embedded media from untrusted origins; the trade-off is reduced media functionality and it does not fully close the vector. Enterprise fleets should verify auto-update is enabled and force the update through management tooling rather than relying on user relaunch.
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today