Google Chrome EUVD-2026-27970

Exploitation requires that the user's Chrome browser have WebCodecs enabled (default configuration) and that the user view or interact with a crafted video file embedded in a web page or opened locally. The vulnerability is not exploitable through passive network sniffing or by sending requests to a Chrome instance running without user interaction. No authentication is required on the target system, but social engineering or physical access to place a malicious video file is typically necessary. The CVSS User Interaction (UI:R) requirement confirms this condition. Exploitation is further limited by Address Space Layout Randomization (ASLR) and heap isolation; reliable data extraction depends on the attacker's ability to predict or brute-force memory offsets, making targeted campaigns more likely than mass exploitation. The Scope:Unchanged (S:U) vector indicates the vulnerability does not escape the Chrome sandbox, preventing code execution or system compromise; impact is strictly information disclosure.

CVSS 4.3 (Low-to-Moderate) with network vector (AV:N) and user interaction requirement (UI:R) indicates this is a practical but not immediately critical threat. Exploitation requires convincing a user to open a crafted video file (via HTML5 video tag, email attachment, or messaging platform), limiting spray-and-forget attacks. EPSS data not provided, but the Chromium-assigned Medium severity suggests the development team sees realistic exploitation potential. The information disclosure impact (C:L) is constrained by memory layout randomization (ASLR) on modern systems, making reliable data extraction difficult without prior knowledge of memory layout. No KEV listing or public POC confirmed in provided data, suggesting this is not yet leveraged in known active campaigns. The user interaction requirement is the strongest mitigating factor; this is not a wormable vulnerability. However, targeted exploitation against specific users (e.g., journalists, activists) to extract session tokens or cached credentials remains plausible.

An attacker crafts a malicious video file (e.g., MP4 with a specially formed codec header) and hosts it on a website or embeds it in a phishing email. When a Chrome user visits the site or opens the email, the browser automatically begins decoding the video via WebCodecs. The out-of-bounds read in the video decoder leaks 32-64 bytes of adjacent heap memory containing session cookies, cached credentials, or other sensitive data. The attacker exfiltrates this data via a timing side-channel or error message to their server. If the leaked data includes a valid session token, the attacker can hijack the victim's account on a web service.