Executive brief
A security vulnerability in Google Chrome's video capture component could allow a remote attacker to access sensitive information from the computer's memory. This attack requires the attacker to have already compromised the browser's graphics processing (GPU) system and then lure a user to a specially crafted website. If successful, this could lead to the exposure of private data or help an attacker bypass further security protections.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the VideoCapture component of Google Chrome. The flaw is reachable by a remote attacker who has already achieved code execution within the GPU process. By enticing a user to visit a malicious HTML page, the attacker can leverage this vulnerability to read sensitive data from the process memory. This issue was addressed in Chrome version 149.0.7827.115 for Windows and Mac, and 149.0.7827.114 for Linux.
Affected products
- Google Chrome prior to 149.0.7827.115
Timeline
- 2026-06-02: disclosed: Reported by Google internal researchers
- 2026-06-11: patched: Fixed in stable channel update 149.0.7827.114/.115
- 2026-06-11: advisory