EUVD-2026-28067Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via web page, no privileges needed, user must visit page; confidentiality-only impact with no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory use in Chrome's WebCodecs component exposes potentially sensitive process memory contents to remote attackers via crafted HTML pages. All Chrome versions prior to 148.0.7778.96 are affected, with the flaw requiring only that a victim navigate to an attacker-controlled page. No active exploitation has been identified; EPSS sits at the 7th percentile and SSVC rates exploitation as none, placing this in the moderate-priority tier despite the high confidentiality impact signaled by CVSS.
Technical ContextAI
The WebCodecs API (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) provides JavaScript with low-level access to audio and video codec processing pipelines inside the Chrome renderer process. CWE-457 (Use of Uninitialized Variable) describes a class of bug where memory is allocated but not zeroed or otherwise initialized before use; when attacker-controlled codec operations trigger reads of that memory, prior allocations in the same process - potentially including credential fragments, decrypted content, or heap artifacts from other tabs - can be returned to script context. Because the renderer process handles cross-origin content and retains residual data from previous operations, the confidentiality impact can be meaningful even if the attacker cannot predict exactly what data will be disclosed.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later, released via the stable channel as documented at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this patch in most managed and consumer deployments; administrators should verify enforcement via policy. For Red Hat and SUSE environments, monitor respective vendor security channels for Chromium package updates. No confirmed workaround is available for this specific WebCodecs flaw - disabling JavaScript entirely would prevent exploitation but renders most web applications unusable. Given low EPSS and no active exploitation, standard patch-cycle deployment (within the next maintenance window) is appropriate rather than emergency remediation.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today