EUVD-2026-66011
GHSA-8hxq-mjhx-ghcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker delivers malicious webpage to victim
-
DeliveryVictim loads page in Chrome
-
ExploitSeparate renderer exploit achieves renderer sandbox code execution
-
InstallAttacker sends crafted media element
-
C2Media component performs out-of-bounds read
-
ExecuteMemory outside renderer sandbox is read
-
ImpactSensitive data exfiltrated
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two distinct, non-trivial preconditions: first, the attacker must have already compromised the Chrome renderer process (this prerequisite is explicitly stated in the CVE description - the vulnerability is not independently exploitable); second, the victim must interact with a crafted HTML page (UI:R as per CVSS vector). The CVSS AC:H rating reflects the high complexity of satisfying the renderer pre-compromise requirement. Limiting factors: requires prior renderer code execution as a chained prerequisite; requires active user interaction; impact is limited to low-severity confidentiality disclosure (C:L) with no integrity or availability impact; does not provide a path to arbitrary code execution on its own. Exploitation against default Chrome installations without a separate chained renderer exploit is not possible. |
| Impact | The overall risk profile is low despite the network delivery vector. The CVSS base score of 3.4 reflects high attack complexity (AC:H), required user interaction (UI:R), and limited confidentiality impact (C:L) with no integrity or availability impact. The decisive limiting factor is that exploitation requires a prior renderer process compromise - explicitly stated in the description - making this a second-stage capability within a multi-vulnerability chain rather than an autonomous exploit. The EPSS score of 0.29% (21st percentile) is consistent with low real-world exploitation activity, and there is no CISA KEV listing. For most organizations this is a routine patch-cycle item rather than an emergency response. The input data carries a 'Buffer Overflow' tag that is technically inaccurate for an out-of-bounds read (CWE-125), which may cause inflated severity signals in automated triage pipelines that conflate read overflows with code-execution-class write overflows. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution within a Chrome renderer process - via a separate, chained renderer vulnerability - delivers a crafted HTML page containing specially constructed media content to the victim. The malformed media element triggers the out-of-bounds read in Chrome's Media component, reading memory outside the renderer sandbox boundary. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
RemediationAI
The primary fix is to upgrade Google Chrome to version 152.0.7977.65 or later, as documented in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Chrome's built-in auto-update mechanism delivers this patch automatically on most desktop installations; enterprise administrators should verify that managed update policies (Google Admin Console or GPO) are not blocking or deferring the update. Because exploitation requires a prior renderer process compromise, organizations operating in high-security environments may additionally audit Chrome's process isolation and Site Isolation settings as a defense-in-depth measure - these raise the bar for the prerequisite renderer exploit but do not remediate the underlying out-of-bounds read. No effective workaround eliminates this vulnerability short of patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Media subsystem, which processes HTML media elements such as audio and video. CWE-125 (Out-of-Bounds Read) identifies the root cause as an improper bounds check during memory reads in media-processing code - the implementation accesses memory beyond the intended buffer boundary. The critical architectural context is Chrome's multi-process sandbox model: the renderer runs in an isolated sandboxed process, and the CVSS Scope metric (S:C) confirms that the out-of-bounds read crosses this sandbox boundary into memory outside the renderer. The affected product is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 152.0.7977.65 across all platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Network delivery via crafted HTML (AV:N), renderer pre-compromise required (AC:H), user must load page (UI:R), sandbox boundary crossed (S:C), limited memory read only (C:L), no write or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB