CVE-2026-11678: Integer Overflow in Chrome libyuv Enables Memory Disclosure

Technical summary

CVE-2026-11678 is an integer overflow in libyuv (CWE-472) affecting Google Chrome versions prior to 149.0.7827.103. The vulnerability resides in image processing code and can be triggered by malicious HTML content. Successful exploitation enables arbitrary memory disclosure from the compromised renderer process context, potentially exposing credentials, tokens, or other sensitive data resident in process memory. The vulnerability has a CVSS 3.1 score of 5.3 (MEDIUM) with a vector of AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting network accessibility, high attack complexity, user interaction requirement, and confidentiality impact without integrity or availability loss.

Business impact

This vulnerability primarily affects organizations relying on Chrome for secure web browsing or embedded web rendering. The attack chain—requiring prior renderer compromise—suggests this is most dangerous in scenarios where users are already targeted by other exploits or malware. Data exfiltration of session tokens, authentication credentials, or personal information could lead to account compromise or identity theft. Organizations using Chrome in kiosk, embedded, or high-assurance environments should treat renderer compromise risks seriously. The vulnerability is not yet tracked as actively exploited in the wild (KEV status: not listed).

Affected systems

Google Chrome versions prior to 149.0.7827.103 are directly affected. The vendor product list also includes Apple macOS, Linux kernel, and Microsoft Windows, likely reflecting that Chrome runs on these platforms. Organizations should verify patching across all Chrome deployments on these operating systems. Chrome-based browsers and Chromium derivatives built before the patched libyuv code may also be vulnerable; check your vendor's patch status independently.

Exploitability

Real-world exploitation requires an attacker to first compromise Chrome's renderer process through a separate vulnerability or attack vector (e.g., a memory corruption bug or prior malware infection). Once inside the renderer, the attacker serves a malicious HTML page with crafted image data that triggers the integer overflow and memory leak. The attack is not remotely exploitable without prior compromise, and it requires user interaction (viewing the HTML). These factors limit immediate widespread risk, though the vulnerability remains serious for users already targeted by other attacks.

Remediation

Update Google Chrome to version 149.0.7827.103 or later. This patch contains a fix for the integer overflow in libyuv. Verify the patch version through Chrome's built-in update mechanism (Settings > About Chrome on desktop platforms) or your organization's Chrome management console. Automatic updates are enabled by default in most Chrome installations. No workaround is available other than updating.

Patch guidance

Deploy Chrome version 149.0.7827.103 or later across all endpoints. For enterprise environments, use Chrome Enterprise or Chrome Browser Cloud Management to enforce automatic updates and verify deployment. Prioritize patching in scenarios where users are likely targets of social engineering or malware campaigns. Test the patch in a limited environment if you maintain custom Chrome builds or extensions. Verify successful deployment by checking chrome://version or querying the browser's version remotely if you have mobile device management (MDM) or endpoint management tools in place.

Detection guidance

Monitor for unusual memory access patterns or process behavior in Chrome renderer processes, though detection via endpoint telemetry is difficult without deep introspection. Network-level detection is not practical since the attack requires prior in-process compromise. Focus on preventing renderer compromise in the first place by: (1) keeping Chrome and all extensions updated, (2) disabling unnecessary extensions, (3) monitoring for signs of malware infection, and (4) using security tools that detect suspicious process behavior. Consider endpoint detection and response (EDR) solutions that can flag anomalous memory reads or process memory dumping attempts.

Why prioritize this

This vulnerability merits prompt but not critical-level attention. The CVSS score of 5.3 reflects the medium baseline severity, but the practical risk depends on your threat model. Prioritize patching if your organization is in a high-risk sector (finance, government, media) or if users are frequently targeted by phishing or malware campaigns. The requirement for prior renderer compromise means this is a secondary concern compared to zero-day renderer exploits themselves. However, if an attacker has already broken into your environment, this vulnerability provides an additional avenue for data exfiltration, so patch it as part of normal security maintenance alongside other Chrome updates.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible vulnerability (AV:N) with high attack complexity (AC:H), no privilege requirement (PR:N), but a requirement for user interaction (UI:R). The impact is confidentiality (C:H) only—sensitive data can be exposed—with no integrity or availability impact. The medium rating appropriately captures that while the vulnerability can leak sensitive information, it requires multiple preconditions: an attacker must first gain renderer process access, and the target must view a malicious page. This differs from a direct remote code execution or unauthenticated network attack.

Frequently asked questions