Google Chrome EUVD-2026-34762

The victim must be running Chrome older than 149.0.7827.53 with the LiveCaption feature actively in use (it is opt-in via Settings → Accessibility → Live Caption and is not enabled by default on most platforms), and must interact with attacker-controlled content - per CVSS UI:R, the user has to visit a page or accept media that delivers the crafted network traffic. No authentication to Chrome or the target site is required (PR:N), and the attack is network-reachable (AV:N), but exploitation is bounded by Chrome's renderer sandbox, so memory disclosure stays within the renderer process unless chained with a sandbox escape. The narrow LiveCaption-enabled prerequisite is the primary limiting factor that reduces the realistic attack surface well below what the 8.8 CVSS suggests.

Signals conflict sharply here: NVD assigns CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H), implying network-reachable, low-complexity, high-impact compromise, but Google's own Chromium severity is Low and the CWE is an out-of-bounds READ (typically info disclosure, not RCE), which makes the C:H/I:H/A:H rating look inflated. EPSS at 0.03% (11th percentile) and the absence of CISA KEV listing or any public POC reinforce that real-world risk is currently low. The most likely realistic outcome is bounded memory disclosure from a renderer process, not full code execution, though the vendor's terse description leaves room for uncertainty - verify with Google's Chromium issue 504180386 once it is opened to the public.

A user with LiveCaption enabled visits an attacker-controlled site or loads media from a malicious peer (e.g., over WebRTC or an HLS/MSE stream); the page delivers a crafted media payload that triggers an out-of-bounds read inside the LiveCaption pipeline, leaking adjacent renderer memory back to the attacker via timing or a follow-on primitive. No public POC is identified at time of analysis, and the UI:R requirement means the victim must interact with the malicious content (visit a page or accept a stream).