Description
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Google Chrome for Windows prior to 150.0.7871.125 has insufficient validation of media input in the renderer process. This flaw, tied to CWE-125 and CWE-20, allows a remote attacker who has already compromised the renderer process to read potentially sensitive information from the renderer process memory. Chromium security reviewers consider the flaw high severity.

Affected Systems

The vulnerability affects Google Chrome browsers running on Windows operating systems that use versions earlier than 150.0.7871.125. The affected product is Chrome for Windows; no other vendors or platforms are mentioned.

Risk and Exploitability

The CVSS score of 5.3 classifies the flaw as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first gain control of the renderer process, as stated in the CVE description. Consequently, the overall risk remains moderate to low.

Generated by OpenCVE AI on August 4, 2026 at 07:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.125 or later on all Windows systems.
  • Configure Chrome’s automatic update settings to ensure the latest security fixes are installed immediately.
  • Until the patch is deployed, consider disabling or restricting media feature usage from untrusted HTML content in Chrome’s settings as a temporary mitigative step.

Generated by OpenCVE AI on August 4, 2026 at 07:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4687-1 chromium security update
Debian DSA Debian DSA DSA-6390-1 chromium security update
History

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation in Chrome Renderer Enables Process Memory Disclosure chromium-browser: chromium-browser: Insufficient validation of untrusted input in Media
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 28 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation in Chrome Renderer Enables Process Memory Disclosure

Sat, 25 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Media Input Validation Flaw in Chrome Renderer Enables Memory Disclosure on Windows

Wed, 22 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
Title Media Input Validation Flaw in Chrome Renderer Enables Memory Disclosure on Windows

Mon, 20 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title Insufficient Validation of Media Input Leads to Memory Disclosure in Google Chrome

Thu, 16 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
Title Insufficient Validation of Media Input Leads to Memory Disclosure in Google Chrome

Wed, 15 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 14 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-14T20:45:08.231Z

Reserved: 2026-07-14T18:31:16.324Z

Link: CVE-2026-15771

cve-icon Vulnrichment

Updated: 2026-07-14T20:45:05.393Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-14T20:09:53Z

Links: CVE-2026-15771 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T07:30:05Z

Weaknesses