CVE-2026-10981: Chrome Cross-Origin Data Leak via Video Codec Flaw

Technical summary

The vulnerability stems from insufficient input validation in Chrome's codec libraries prior to version 149.0.7827.53. When processing untrusted video files, the codec implementation fails to properly validate input, allowing a compromised renderer process to read memory contents that should be protected by cross-origin boundaries. The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact but no integrity or availability risk, and acknowledges that user interaction and prior renderer compromise are prerequisites. Chromium classifies this as High severity due to the nature of data exposure.

Business impact

For enterprise environments, this vulnerability is relevant primarily to organizations with restrictive browser policies or where sensitive information is accessed through web applications. The data leak potential means that users visiting sites hosting malicious videos—or whose systems are already compromised—face risk of credential theft, session hijacking, or exposure of confidential data viewed in other tabs. However, the requirement for renderer compromise reduces the likelihood of widespread exploitation compared to direct-trigger vulnerabilities. Organizations should weigh this against the generally low attack probability outside targeted scenarios.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. This includes stable, beta, dev, and canary release channels. The vulnerability affects all desktop platforms where Chrome is deployed (Windows, macOS, Linux). Mobile Chrome versions built from the same Chromium codebase prior to the fix are also potentially affected; verify exact version numbers for Chromium-based browsers like Edge, Brave, Opera, and other Chromium derivatives against their respective vendor advisories.

Exploitability

Exploitation requires two conditions: (1) the renderer process must already be compromised or under attacker control, and (2) the user must interact with a crafted video file. This is not an unauthenticated remote code execution. An attacker might chain this with a separate renderer-process exploit, or deploy the malicious video through a compromised web server, watering-hole attack, or supply-chain compromise. As a solo vulnerability, the bar for exploitation is elevated, but the data exposure severity justifies attention.

Remediation

Upgrade Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism will push this update to most users automatically, though verification of installed versions is recommended in managed environments. For organizations using Chromium-based browsers other than Chrome, check the respective vendor advisories for patched versions. No workarounds are available beyond upgrading.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later across managed systems. Most end-user systems will auto-update within days of release; however, organizations with update management policies should verify completion. Prioritize systems where users frequently handle video files from untrusted sources (e.g., email attachments, public downloads) or where sensitive data is regularly accessed in browser sessions. For enterprises using managed Chrome deployments (e.g., via AD or MDM), test the patch in a non-production environment first to rule out compatibility issues, then roll out gradually.

Detection guidance

Endpoint detection should verify Chrome versions via patch management tools or EDR agents that report installed software versions. Monitor for Chrome crashes or unexpected memory access patterns if available through browser telemetry. Network-level detection of this flaw is difficult; focus on ensuring patch compliance. If forensic analysis is needed post-incident, examine Chrome renderer process memory dumps for evidence of cross-origin data access, though such analysis typically requires specialized tools and incident response expertise.

Why prioritize this

Although the CVSS score is MEDIUM (6.5) and the vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, prioritize patching for business-critical or high-security systems within 30 days. The confidentiality impact (high) and the codec attack surface (frequently overlooked during security assessments) warrant attention. Deprioritize only in environments where Chrome is restricted or not used for sensitive work. This is not an emergency but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects: high confidentiality impact (C:H) due to cross-origin data exposure, no integrity or availability impact (I:N, A:N), network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and required user interaction (UI:R). The score appropriately penalizes the vulnerability for requiring user interaction and prior renderer compromise, preventing a higher score. However, Chromium's internal assessment of High severity signals that the real-world risk may be elevated in targeted attack scenarios.

Frequently asked questions