EUVD-2026-116432
GHSA-wvg4-q82q-6fpg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryServe malicious media content
-
ExploitTrigger out-of-bounds read in Media component
-
ExecutionCorrupt renderer process memory
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or navigate to an attacker-controlled HTML page in a vulnerable Chrome build (prior to 157.0.8103.38) that embeds crafted media processed by the Media component - this user interaction (UI:R) is the primary limiting factor, as the attacker cannot trigger the bug without the user loading the page. No authentication or privileges are needed (PR:N) and default Chrome configurations on the desktop are affected. The critical limiting factor beyond user interaction is the sandbox boundary: successful exploitation yields code execution only inside the renderer sandbox (S:U), so host compromise additionally requires chaining a separate sandbox-escape vulnerability. |
| Impact | This is a genuine, high-priority patch item but not a drop-everything emergency, consistent with the input's 'this_week' decision label. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a trivially met condition for a web browser - which justifies the 8.8 base score with C:H/I:H/A:H. The key tempering signal is explicit in the description: code execution occurs 'inside the sandbox' (S:U), so a single exploitation of this bug yields control of the renderer process only, not the host, and a full compromise would require chaining a separate sandbox-escape vulnerability. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no confirmed exploit code is present in the input (the issues.chromium.org link is the vendor bug tracker, not a PoC), so there is no evidence of active exploitation or widespread weaponization at this time. Net: real priority driven by ubiquity and remote/unauthenticated reach, moderated by the sandbox boundary and absence of exploitation signals. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing specially crafted media content and lures a victim into visiting it with a vulnerable Chrome build. When the page's media is parsed, the out-of-bounds read in the Media component is triggered, letting the attacker potentially execute arbitrary code within the renderer sandbox. No public exploit was identified in the provided data; a separate sandbox-escape bug would be needed to affect the underlying system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Out-of-bounds read in Chrome's Media component allows a remote attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code inside the renderer sandbox on Chrome builds prior to 157.0.8103.38. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and because the sandbox is intact (S:U), host compromise would additionally require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and a vendor patch is available, making this a high-priority this-week patch item rather than an emergency.
RemediationAI
Vendor-released patch: update Google Chrome to 157.0.8103.38 or later; this is the complete fix, since the defect is in shipped browser code and no configuration switch is documented as removing the exposure. Distribute the update through the normal stable-channel mechanism or Chrome Enterprise auto-update policies, confirm the installed version after the browser restarts, and prioritize endpoints where users browse untrusted content. Until a host is updated, exposure depends on a user loading an attacker-controlled page that embeds crafted media, and the blast radius of any successful exploitation remains the renderer sandbox rather than the host, so exploitation of the host would also require a separate sandbox-escape flaw. Full details and the version mapping are in the vendor advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html and the tracking issue at https://issues.chromium.org/issues/577402416.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-125 out-of-bounds read in the Chromium Media component, the subsystem that parses media containers and drives audio/video decoding for HTML media elements; the affected artifact is the google:chrome CPE entry covering all builds below 157.0.8103.38. An out-of-bounds read means the code accesses memory beyond the bounds of an allocated buffer, which in a browser media pipeline typically surfaces as information disclosure and can, under the right heap layout, contribute to memory corruption and code execution within the renderer. Chrome's site isolation and renderer sandbox constrain the outcome: the CVSS scope is Unchanged (S:U), so the security boundary crossed is the renderer, not the host, and the assessment records arbitrary code execution as achievable only inside that sandbox. The specific media format, parser path and malformed input structure that trigger the read are not described in the available sources; the CVSS metrics (AC:L, PR:N, UI:R) describe severity and prerequisites, not the trigger mechanism. The vendor rates the issue High in Chromium security severity, consistent with the 8.8 CVSS and the C:H/I:H impact ratings.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; viewing the page is UI:R; code execution stays in the renderer process so S:U with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
CVE-2026-121208 is a high-severity vulnerability in the Media component of Google Chrome that could allow an attacker to execute arbitrary code within the browser's renderer sandbox when a user visits a specially crafted webpage. While exploitation requires user interaction and a separate sandbox-escape to compromise the host, a patch is available. Given Chrome's widespread use across the organization, unpatched browsers represent a significant risk to endpoint integrity and data confidentiality.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB