CVE-2026-8569

chromium-browser: chromium-browser: Out of bounds write in Codecs

View on CVE.org
Published May 14, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Description
Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

An out‑of‑bounds write in the Codecs component of Google Chrome on macOS versions prior to 148.0.7778.168 can be triggered by a specially crafted video file. The flaw allows a remote attacker to escape the browser sandbox, potentially enabling the execution of arbitrary code on the host system. The weakness is classified as CWE‑787.

Affected Systems

The vulnerability affects Google Chrome running on macOS devices. Versions before 148.0.7778.168 are vulnerable; later releases contain the fix.

Risk and Exploitability

No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.3, indicating high severity. The medium Chromium severity rating suggests that while the flaw is serious, attackers would need to supply a crafted video to the target. The risk is contingent on user interaction with malicious media, but a sandbox escape permits full compromise of the host. The lack of public exploit data implies the threat may still be low to moderate but the potential impact warrants prompt remediation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Chrome update 148.0.7778.168 or later
  • Enable Chrome auto‑update to receive security patches automatically
  • Avoid opening unknown or suspicious video files until the browser is updated

Generated by OpenCVE AI on May 14, 2026 at 23:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6273-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Title Out-of-Bounds Write in Google Chrome Codecs Allows Sandbox Escape via Crafted Video File on macOS chromium-browser: chromium-browser: Out of bounds write in Codecs
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Out-of-Bounds Write in Google Chrome Codecs Allows Sandbox Escape via Crafted Video File on macOS
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
Weaknesses CWE-787
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
May 15, 2026, 3:57 AM
Reserved
May 14, 2026, 5:40 AM

View source JSON

Updated
May 14, 2026, 9:18 PM

JSON

Status
Analyzed
Published
May 14, 2026, 8:17 PM
Modified
Oct 26, 2026, 2:10 PM

View source JSON

Severity
Moderate
Public date
May 14, 2026, 7:52 PM

View source Bugzilla JSON

Updated
May 14, 2026, 11:45 PM

JSON