EUVD-2026-33138
GHSA-2vm7-4348-jv9f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in the WebRTC subsystem of Google Chrome on macOS (versions prior to 148.0.7778.216) enables remote attackers to exfiltrate potentially sensitive data from browser process memory by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N) confirms network-reachable, unauthenticated exploitation with confidentiality-only impact, but mandates user interaction, limiting fully passive attack scenarios. No active exploitation has been confirmed in CISA KEV, and an EPSS score of 0.03% at the 10th percentile reflects low observed exploitation probability at time of analysis; no public exploit code has been identified.
Technical ContextAI
The vulnerability resides in WebRTC (Web Real-Time Communication), the browser subsystem handling audio/video streaming, peer-to-peer data channels, and real-time media negotiation natively within Chrome. CWE-125 (Out-of-bounds Read) identifies the root cause: a memory read operation that accesses data beyond the boundary of its allocated buffer. In WebRTC's complex media processing pipeline - which involves parsing SDP session descriptors, RTP/RTCP packets, and codec-specific payloads - such flaws typically arise when attacker-controlled input causes a length or index miscalculation, permitting reads into adjacent memory regions. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome application versions; the Mac-specific constraint per the CVE description suggests the vulnerable code path or memory layout difference is isolated to Chrome's macOS build, potentially in a platform-specific WebRTC codec or IPC layer.
RemediationAI
Upgrade Google Chrome on macOS to version 148.0.7778.216 or later, which contains the vendor-released patch as documented in the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's built-in auto-update mechanism will deliver this version upon browser restart; administrators and users should verify the installed version by navigating to chrome://settings/help and confirming 148.0.7778.216 or higher. If immediate patching is not feasible in managed environments, restricting user navigation to untrusted or unvetted HTML content via web proxy filtering or Safe Browsing enforcement reduces exposure. Disabling WebRTC entirely via Chrome enterprise policy (setting WebRtcAllowed to false) would eliminate the attack surface at the cost of breaking all WebRTC-dependent functionality including video conferencing, screen sharing, and peer-to-peer data transfer - this is a significant operational trade-off and is recommended only as a temporary measure while patching is coordinated.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today