EUVD-2026-33138
GHSA-2vm7-4348-jv9f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in the WebRTC subsystem of Google Chrome on macOS (versions prior to 148.0.7778.216) enables remote attackers to exfiltrate potentially sensitive data from browser process memory by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N) confirms network-reachable, unauthenticated exploitation with confidentiality-only impact, but mandates user interaction, limiting fully passive attack scenarios. No active exploitation has been confirmed in CISA KEV, and an EPSS score of 0.03% at the 10th percentile reflects low observed exploitation probability at time of analysis; no public exploit code has been identified.
Technical ContextAI
The vulnerability resides in WebRTC (Web Real-Time Communication), the browser subsystem handling audio/video streaming, peer-to-peer data channels, and real-time media negotiation natively within Chrome. CWE-125 (Out-of-bounds Read) identifies the root cause: a memory read operation that accesses data beyond the boundary of its allocated buffer. In WebRTC's complex media processing pipeline - which involves parsing SDP session descriptors, RTP/RTCP packets, and codec-specific payloads - such flaws typically arise when attacker-controlled input causes a length or index miscalculation, permitting reads into adjacent memory regions. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome application versions; the Mac-specific constraint per the CVE description suggests the vulnerable code path or memory layout difference is isolated to Chrome's macOS build, potentially in a platform-specific WebRTC codec or IPC layer.
RemediationAI
Upgrade Google Chrome on macOS to version 148.0.7778.216 or later, which contains the vendor-released patch as documented in the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's built-in auto-update mechanism will deliver this version upon browser restart; administrators and users should verify the installed version by navigating to chrome://settings/help and confirming 148.0.7778.216 or higher. If immediate patching is not feasible in managed environments, restricting user navigation to untrusted or unvetted HTML content via web proxy filtering or Safe Browsing enforcement reduces exposure. Disabling WebRTC entirely via Chrome enterprise policy (setting WebRtcAllowed to false) would eliminate the attack surface at the cost of breaking all WebRTC-dependent functionality including video conferencing, screen sharing, and peer-to-peer data transfer - this is a significant operational trade-off and is recommended only as a temporary measure while patching is coordinated.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today