Description
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
Published: 2026-04-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Heap corruption
Action: Patch immediately
AI Analysis

Impact

An integer overflow occurs in the media component of Google Chrome versions older than 147.0.7727.55. The flaw allows a crafted video file to corrupt heap memory during decoding, creating a potential vulnerability for arbitrary code execution. The defect is classified under CWE-190 (Integer Overflow) and CWE-472 (Incorrect Index).

Affected Systems

The vulnerability affects Google Chrome browsers on Windows, macOS, and Linux platforms. Users running any Chrome version prior to 147.0.7727.55 are susceptible, regardless of operating system or installation location.

Risk and Exploitability

The flaw carries a high severity rating of 8.8 and an exploit likelihood estimated below 1%, indicating that active exploitation is unlikely and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need a victim to open a maliciously crafted video file or link that automatically plays the media, after which the heap corruption could be leveraged to compromise the browser or underlying system.

Generated by OpenCVE AI on April 14, 2026 at 15:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 147.0.7727.55 or newer via the stable channel.
  • Verify that the browser reports the updated version to confirm the patch has been applied.

Generated by OpenCVE AI on April 14, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6205-1 chromium security update
History

Tue, 14 Apr 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 10 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Integer overflow in Media
Weaknesses CWE-190
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 10 Apr 2026 10:00:00 +0000

Type Values Removed Values Added
Title Integer Overflow in Media Handling Leading to Potential Heap Corruption in Chrome

Thu, 09 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 09 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
Title Integer Overflow in Media Handling Leading to Potential Heap Corruption in Chrome
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 08 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
Description Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
Weaknesses CWE-472
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-29T15:12:50.902Z

Reserved: 2026-04-08T19:34:45.984Z

Link: CVE-2026-5910

cve-icon Vulnrichment

Updated: 2026-04-09T15:12:02.620Z

cve-icon NVD

Status : Modified

Published: 2026-04-08T22:16:30.900

Modified: 2026-04-29T16:16:27.177

Link: CVE-2026-5910

cve-icon Redhat

Severity : Low

Publid Date: 2026-04-07T00:00:00Z

Links: CVE-2026-5910 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:37:23Z

Weaknesses