EUVD-2026-30395
GHSA-jv86-hcwp-f7cf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the victim to open it (UI:R); code execution fully compromises the renderer (C/I/A:H) yet stays sandboxed (S:U).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Remote code execution in Google Chrome before 148.0.7778.168 stems from an integer overflow in the browser's font handling code, allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code - though notably constrained to run inside the renderer sandbox rather than achieving full host compromise. The flaw carries a CVSS of 8.8 but is rated Medium by Chromium's own severity scale, reflecting the sandbox containment. There is no public exploit identified at time of analysis, EPSS is very low (0.08%), and CISA SSVC records exploitation status as none.
Technical ContextAI
The vulnerability lives in Chrome's font subsystem (glyph/font parsing and rendering), which processes untrusted font data referenced or embedded by web pages inside the renderer process. An integer overflow during a size or offset computation can lead to an undersized allocation or out-of-bounds memory access, which an attacker grooms into memory corruption and ultimately code execution within the sandboxed renderer. The affected component is the Chromium/Blink rendering engine shared by all Chromium-based products (Chrome, and by extension Red Hat/SUSE-packaged builds and other downstream browsers). Note a data inconsistency: the assigned CWE-472 (External Control of Assumed-Immutable Web Parameter) does not match the description's 'integer overflow', which is properly CWE-190 (Integer Overflow or Wraparound); treat the description as authoritative and the CWE tag as likely mis-assigned.
RemediationAI
Vendor-released patch: update Google Chrome to 148.0.7778.168 or later on all desktop platforms via the Stable channel update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html); Chrome auto-update applies this on relaunch, so ensure users fully restart the browser rather than leaving long-running sessions open. For managed fleets, push the update through enterprise policy or patch management and verify the reported version. Users of Chromium-based downstream builds (Red Hat, SUSE, and other repackagers) should apply their distribution's corresponding update once it ships the fixed engine. If patching must be delayed, the practical compensating control is user-facing: avoid untrusted sites and consider restricting or blocking web font loading, while keeping site isolation and the renderer sandbox enabled (both default), accepting that disabling web fonts degrades rendering on legitimate sites; no reliable network-level block exists since delivery is ordinary HTTPS page content.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today