Description
Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-25
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An improper input validation flaw (CWE-20) in the Media component of Google Chrome before 152.0.7977.65 can allow a remote attacker to potentially execute arbitrary code outside the browser sandbox by delivering a specially crafted HTML page. The vulnerability is rated high by Chromium and could compromise confidentiality, integrity, and availability by giving the attacker system‑level access.

Affected Systems

All users running Google Chrome versions older than 152.0.7977.65 are affected, regardless of operating system. This includes the stable channel of Chrome on desktop platforms.

Risk and Exploitability

With a CVSS score of 9.6, the vulnerability is rated high severity. The attack vector is remote via a web page, requiring the victim to load the malicious content. The EPSS score of 0.0035 indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. At this time there are no known public exploit samples, but the potential for exploitation remains high due to the remote nature and lack of a sandbox bypass prevention in affected releases.

Generated by OpenCVE AI on August 26, 2026 at 20:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to 152.0.7977.65 or later as soon as possible—this patch fixes the improper input validation flaw (CWE‑20).
  • If an immediate upgrade is unavailable, disable the Media component or HTML5 video/audio support via Chrome flags or group policy to mitigate the CWE‑20 input validation vulnerability.
  • Ensure the system sandboxing features remain enabled and properly configured to contain any attempt of code bypass.
  • Regularly monitor Chrome release notes and apply security patches as they become available.

Generated by OpenCVE AI on August 26, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Thu, 27 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Thu, 27 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Wed, 26 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T03:57:53.708Z

Reserved: 2026-08-25T06:03:57.486Z

Link: CVE-2026-78900

cve-icon Vulnrichment

Updated: 2026-08-26T16:13:35.997Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:17:47.410

Modified: 2026-08-27T16:24:11.400

Link: CVE-2026-78900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T20:30:11Z

Weaknesses
  • CWE-20

    Improper Input Validation