Description
Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out-of-bounds read in the Codecs component of Google Chrome allows a remote attacker to read sensitive information from process memory through a specially crafted HTML page. The issue, identified as CWE-125, can expose data that should remain confidential, presenting a medium severity risk to user information privacy.

Affected Systems

Chrome versions prior to 150.0.7871.47 on all supported operating systems are affected. Any installation of the vulnerable browser can be compromised if the user loads a malicious web page containing the exploit code.

Risk and Exploitability

With a CVSS score of 6.5, this vulnerability is moderately severe. No EPSS data is currently available, and it is not listed in the CISA KEV catalog. Exploitation requires only remote access; an attacker must deliver a crafted page that the victim opens, and no special privileges are needed beyond normal browsing. The vulnerability is fully remote and does not rely on local execution or extra user interaction beyond visiting the malicious site.

Generated by OpenCVE AI on July 1, 2026 at 14:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Chrome update (version 150.0.7871.47 or later) to eliminate the out-of-bounds read flaw.
  • Enable automatic updates in Chrome settings to receive future security patches without manual intervention.
  • Use Chrome's Safe Browsing feature and avoid opening URLs from untrusted or suspicious sources until the update is applied.

Generated by OpenCVE AI on July 1, 2026 at 14:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 01 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in Chrome Codecs Enables Remote Information Disclosure

Wed, 01 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read in Chrome Codecs Allows Retrieval of Sensitive Process Memory via Crafted HTML Page

Wed, 01 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Out of Bounds Read in Chrome Codecs Allows Retrieval of Sensitive Process Memory via Crafted HTML Page

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-125
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T01:32:36.457Z

Reserved: 2026-06-29T23:03:49.013Z

Link: CVE-2026-13906

cve-icon Vulnrichment

Updated: 2026-07-01T01:32:31.951Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T14:30:05Z

Weaknesses