# CVE-2026-12026: Google ChromeOS out of bounds read in Video component

Source: https://junglewise.ai/threats/cve-2026-12026-google-chromeos-out-of-bounds-read-in-video-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-12026 · Severity: info · Published 2026-06-11

A security vulnerability in the video processing component of Google Chrome on ChromeOS could allow an attacker to access sensitive information. By tricking a user into visiting a specially crafted website, an attacker who has already partially compromised the browser's internal processes could read data from the system's memory that they should not have access to. This could lead to the exposure of private user data or credentials stored in memory.

Technologies: [Google ChromeOS](https://junglewise.ai/threats/technologies/chromeos). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-12026 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12026 being exploited in the wild.

**How severe is CVE-2026-12026?** Informational severity, published 11 June 2026.

**Which products and versions are affected?** Google ChromeOS prior to 149.0.7827.115.

**Is there a fix for CVE-2026-12026?** A patch was published on 2026-06-11: Fixed in ChromeOS version 149.0.7827.115 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12026 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-12026?** Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the Video component of Google Chrome on ChromeOS versions prior to 149.0.7827.115. The flaw is exploitable by a remote attacker who has already achieved a compromise of the renderer process. By enticing a user to load a malicious HTML page, the attacker can leverage this vulnerability to read sensitive information from the process memory. This issue was identified by Google internally and has been addressed in the stable channel update to version 149.0.7827.115.

## Affected products

- Google ChromeOS prior to 149.0.7827.115

## Timeline

- 2026-05-28: other: Reported by Google internal researchers
- 2026-06-11: patched: Fixed in ChromeOS version 149.0.7827.115
- 2026-06-11: advisory

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html)
- [https://issues.chromium.org/issues/517347084](https://issues.chromium.org/issues/517347084)

## Related threats

- [Google ChromeOS heap buffer overflow in Color component](https://junglewise.ai/threats/cve-2026-17680-google-chromeos-heap-buffer-overflow-in-color-component)
- [Google ChromeOS uninitialized use in Dawn](https://junglewise.ai/threats/cve-2026-14421-google-chromeos-uninitialized-use-in-dawn)
- [Google Chrome on ChromeOS use after free in SSL](https://junglewise.ai/threats/cve-2026-14103-google-chrome-on-chromeos-use-after-free-in-ssl)
- [Google ChromeOS out of bounds read in CameraCapture](https://junglewise.ai/threats/cve-2026-14090-google-chromeos-out-of-bounds-read-in-cameracapture)
- [Google Chrome on ChromeOS Information Disclosure in Views](https://junglewise.ai/threats/cve-2026-14062-google-chrome-on-chromeos-information-disclosure-in-views)