Description
Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in Google Chrome’s codec implementation allows a remote attacker to read data from process memory via a specially crafted HTML page. This vulnerability (CWE‑416) is a classic memory corruption issue (CWE‑825) that can result in private data leakage without requiring elevated privileges.

Affected Systems

Chrome versions earlier than 149.0.7827.53 on all supported operating systems—Windows, macOS, and Linux—are affected, as the buggy code resides in the core codec library shared across platforms.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% shows a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to deliver a malicious HTML page; any Chrome user who opens such a page is potentially vulnerable, and the flaw can lead to memory disclosure without elevated privileges.

Generated by OpenCVE AI on June 7, 2026 at 16:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 149.0.7827.53 or later to eliminate the use‑after‑free bug
  • Configure enterprise browser policies to block or strictly filter content from untrusted domains
  • Confirm that the Chrome sandbox is enabled so that any process isolation limits the impact

Generated by OpenCVE AI on June 7, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Codecs
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 06 Jun 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 05 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Title Chromium Use‑After‑Free in Codecs Allows Remote Memory Disclosure via Crafted HTML

Fri, 05 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 05:15:00 +0000

Type Values Removed Values Added
Title Chromium Use‑After‑Free in Codecs Allows Remote Memory Disclosure via Crafted HTML

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T15:38:19.923Z

Reserved: 2026-06-04T17:10:50.343Z

Link: CVE-2026-11208

cve-icon Vulnrichment

Updated: 2026-06-05T14:39:56.428Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:28.057

Modified: 2026-06-06T01:58:56.390

Link: CVE-2026-11208

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11208 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T16:45:04Z

Weaknesses