Executive brief
Google Chrome is a widely used web browser. A vulnerability in its media processing component could allow a malicious website to bypass security protections designed to isolate the browser from the rest of the computer. If successfully exploited, an attacker could gain unauthorized access to the underlying operating system, potentially leading to data theft or full system compromise.
Technical details
A heap buffer overflow vulnerability exists in the Codecs component of Google Chrome for Linux and ChromeOS. The flaw is categorized as an out-of-bounds write (CWE-787). An attacker can exploit this by enticing a user to visit a specially crafted HTML page. If the attacker has already compromised the renderer process, they can leverage this overflow to achieve a sandbox escape, potentially gaining execution privileges on the host operating system. The issue was addressed in version 149.0.7827.115.
Affected products
- Google Chrome prior to 149.0.7827.115
Timeline
- 2026-05-26: disclosed: Reported by Google internal researchers
- 2026-06-11: patched: Fixed in Stable Channel Update 149.0.7827.115
- 2026-06-11: advisory