CVE-2026-11668: Chrome Codec Uninitialized Memory Data Leak (v149.0.7827.103 Patch)

Technical summary

CVE-2026-11668 is an uninitialized use vulnerability (CWE-457) in Google Chrome's codec processing pipeline. The weakness allows an attacker to read uninitialized memory regions that may contain cross-origin data, bypassing the same-origin policy. The vulnerability requires a user to interact with a crafted video file, but no authentication or special privileges are needed on the attacker's side. The issue is present in Chrome versions before 149.0.7827.103 on Linux systems and all Chrome OS versions prior to that build. Google assigned it a High severity rating in their internal security framework, reflected in the CVSS 3.1 MEDIUM score (4.3) due to the requirement for user interaction and the lack of impact on system integrity or availability.

Business impact

This vulnerability exposes organizations to information disclosure risks, particularly for environments where Chrome or Chrome OS devices access sensitive web applications. An attacker could harvest authentication tokens, session identifiers, or sensitive user data by inducing users to click on specially crafted video content. For enterprises managing Chrome deployments, this represents both a direct user-facing risk and a potential lateral movement vector if stolen credentials are leveraged. The relatively low CVSS score should not be mistaken for low risk in contexts where data confidentiality is critical.

Affected systems

The vulnerability affects Google Chrome and Chrome OS systems running versions prior to 149.0.7827.103. Linux-based Chrome installations are explicitly impacted. While the CVE listing references the Linux kernel as a affected product, the vulnerability is specific to Google's codec implementation within Chrome, not the kernel itself. Organizations should assume all Chrome and Chrome OS deployments in their environment are at risk until patched to version 149.0.7827.103 or later.

Exploitability

The attack is relatively straightforward from an attacker perspective: a malicious video file is the only required payload. The attack requires user interaction—the victim must open or play the crafted video—but social engineering to achieve this is trivial. No special network conditions or privilege escalation are needed. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog, suggesting active in-the-wild exploitation has not been documented at publication time, though this does not guarantee it will not be exploited in the future.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all affected Linux systems. For Chrome OS, update to the equivalent build (149.0.7827.103 or later) via the automatic update mechanism. Organizations should verify patch deployment across their device fleet and confirm that auto-update is enabled to prevent regression. Test video playback functionality in your environment after patching to ensure codec functionality remains intact.

Patch guidance

Verify and deploy Google Chrome version 149.0.7827.103 or later. For Chrome OS devices, confirm that the system has received the security update by checking Settings > About Chrome OS; the system should report version 149.0.7827.103 or higher. Linux users should update via their package manager or by downloading the latest stable Chrome binary directly from Google. Stagger updates across your environment if running large deployments to minimize disruption. No rollback is necessary unless compatibility issues arise; the patch is low-risk.

Detection guidance

Monitor for unusual patterns of video file downloads or users clicking on suspicious video links. Endpoint detection and response (EDR) tools may flag codec-related crashes or abnormal memory access patterns in Chrome processes, though this vulnerability does not guarantee detectable behavioral indicators. Network-based detection is limited since the attack relies on file content rather than protocol anomalies. Focus detection efforts on user awareness and social engineering indicators that might precede a craft video payload being sent to targets.

Why prioritize this

While the CVSS score is moderate (4.3 MEDIUM), the vulnerability should be prioritized for patching due to: (1) ease of exploitation requiring only a crafted file and user click, (2) potential for sensitive data leakage in environments handling confidential information, (3) the attack surface is broad—any website or email can serve the malicious video, and (4) Chrome's ubiquity makes widespread exploitation feasible. Organizations with high-value data should patch urgently; others should patch within 2-4 weeks.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a MEDIUM severity because the vulnerability requires user interaction and results only in confidentiality impact (data leakage), with no integrity or availability effects. The network attack vector and low attack complexity increase the base score, but the user interaction requirement and single-impact scope limit it. In practical terms, organizations handling sensitive data should treat this as higher-priority than the score alone suggests, as stolen credentials or personal information can enable further compromise.

Frequently asked questions