EUVD-2026-30449
GHSA-cx47-c55q-jxc3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; UI:R for crafted JPEG interaction; C:H for memory disclosure; I:N and A:N as no write or crash impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted JPEG file. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in the Media component of Google Chrome on Linux and ChromeOS exposes sensitive process memory to a remote attacker who has already achieved renderer process compromise. Affected are all Chrome versions prior to 148.0.7778.168 on Linux and ChromeOS; Windows and macOS are explicitly excluded. No public exploit or active exploitation is identified - EPSS stands at 0.03% and SSVC exploitation status is confirmed none - but this functions as a high-value chaining primitive in multi-stage browser exploit chains.
Technical ContextAI
The vulnerability is a CWE-125 Out-of-bounds Read in Chrome's Media subsystem, triggered during JPEG file parsing. Out-of-bounds reads in media decoders occur when a decoder accesses memory beyond allocated buffer boundaries without sufficient bounds validation, allowing adjacent memory regions to be read. The affected product is scoped via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* to versions below 148.0.7778.168, on Linux and ChromeOS platforms only. The vulnerability sits inside the renderer process - Chrome's sandboxed content-handling layer - which limits the direct blast radius but makes it a useful second-stage tool for attackers who have already breached the renderer through a separate flaw.
RemediationAI
Update Google Chrome to version 148.0.7778.168 or later on Linux and ChromeOS, as released by Google and documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Red Hat and SUSE users should monitor their respective security advisories for downstream Chromium package updates, as these distributions may lag the upstream Chrome release. Because exploitation requires a pre-compromised renderer as a precondition, organizations can reduce the likelihood of the prerequisite being met by enforcing Chrome's V8 sandbox and Site Isolation policies, which limit renderer-level exploit reliability. As a temporary measure, restricting automatic media loading via enterprise browser policy (e.g., setting DefaultPluginsSetting or ContentSettings for images/media) reduces JPEG parsing exposure, though this degrades normal browsing functionality and should be treated as a short-term compensating control only.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today