EUVD-2026-36353
GHSA-vrf3-m22c-r362
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory GPU process pre-compromise; UI:R for crafted HTML page interaction; C:H for GPU memory leak; no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Google Chrome's VideoCapture component leaks GPU process memory to remote attackers who have already established a foothold in the GPU sandboxed process. Versions prior to 149.0.7827.115 are affected across all platforms, with downstream impact noted for SUSE and Red Hat Chromium packages. This is a chained exploitation scenario requiring a prior GPU process compromise plus user interaction; no public exploit identified at time of analysis, and EPSS probability of 0.03% (8th percentile) alongside SSVC exploitation status of 'none' confirm minimal current threat activity.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) manifests in Chrome's VideoCapture subsystem, which handles camera and video input processing within the browser's multi-process architecture. Chrome isolates rendering, GPU, and network functions into separate sandboxed processes; the GPU process handles graphics acceleration and, in this case, video capture operations. An out-of-bounds read occurs when code accesses memory beyond a valid buffer boundary - in this context, leaking adjacent memory contents from the GPU process heap or stack. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all platform variants of Google Chrome prior to 149.0.7827.115 are in scope. The Chromium security severity is rated High by Google's internal rubric, which typically maps to CVSS 7.x-8.x when standalone, but the chained prerequisite drives the NVD score down to 5.3.
RemediationAI
The primary fix is updating Google Chrome to version 149.0.7827.115 or later, as confirmed by the vendor release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. Chrome's auto-update mechanism will deliver this update to most users without manual intervention; administrators managing enterprise deployments should push this version via policy. SUSE and Red Hat users running distribution-packaged Chromium should apply updates through their respective package managers (zypper or dnf) once patched packages are published - tracking those vendors' security channels is advised. No complete workaround exists that fully mitigates this without patching. As a partial risk reduction measure, revoking camera/VideoCapture permissions for untrusted sites via Chrome's site settings (chrome://settings/content/camera) narrows the VideoCapture attack surface, though this does not eliminate the vulnerability and may impact legitimate video conferencing use. The more impactful mitigation is addressing any prior GPU process compromise vectors by keeping Chrome fully updated, as this vulnerability is only reachable post-GPU-compromise.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today