EUVD-2026-35269
GHSA-4m59-9rc7-xwfx
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Media in Google Chrome on ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Chrome's Media component on ChromeOS allows an attacker who has already compromised the renderer process to exfiltrate potentially sensitive data from process memory via a crafted HTML page. Affected are all Chrome for ChromeOS releases prior to 149.0.7827.103. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by both the ChromeOS-only scope and the mandatory prerequisite of a pre-compromised renderer, making this a chained attack scenario rather than a standalone critical threat.
Technical ContextAI
The vulnerability resides in Chrome's Media subsystem - the component responsible for parsing and rendering media content embedded in HTML pages - specifically on the ChromeOS platform. An out-of-bounds read occurs when the Media component accesses memory beyond a valid buffer boundary while processing attacker-controlled media content delivered via a crafted HTML page. The assigned CWE is CWE-472 (External Control of Assumed-Immutable Web Parameter), which describes web parameters that should be immutable but can be tampered with externally; however, this classification is inconsistent with the described out-of-bounds read primitive, and CWE-125 (Out-of-Bounds Read) would be a more typical mapping. The 'Buffer Overflow' tag in the source data is similarly imprecise for a read-only memory boundary violation. The CVSS vector (S:U, C:H, I:N, A:N) confirms this is a confidentiality-only impact with no write or availability consequence, consistent with a memory-disclosure primitive. Affected versions are Chrome on ChromeOS prior to 149.0.7827.103.
RemediationAI
The primary remediation is to update Google Chrome on ChromeOS to version 149.0.7827.103 or later, as confirmed by the vendor's Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. ChromeOS devices managed via enterprise policies should ensure auto-update is not blocked and that the update is pushed to the fleet. As a compensating control where immediate patching is not possible, restricting access to untrusted or external web content through enterprise managed browser policies (e.g., URL allowlisting via ChromeOS admin console) reduces attacker ability to deliver the crafted HTML page required for exploitation. Note that this control does not address the underlying vulnerability and only raises the bar for the delivery stage; the renderer compromise prerequisite also remains a distinct attack surface requiring its own mitigations. No side effects have been reported for the patch itself.
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today