CVE-2026-12026: Chrome ChromeOS Out-of-Bounds Memory Read in Video Component

Technical summary

CVE-2026-12026 is an out-of-bounds read vulnerability (CWE-125) in Chrome's video subsystem affecting ChromeOS versions prior to 149.0.7827.115. An out-of-bounds read occurs when code accesses memory beyond the intended buffer boundaries, allowing an attacker to read adjacent memory containing uninitialized or sensitive data. In this case, a compromised renderer process can trigger the flaw through crafted HTML, enabling disclosure of process memory. The vulnerability is classified by the Chromium project as High severity, though the CVSS 3.1 score of 6.5 (Medium) reflects the prerequisite that renderer compromise is required.

Business impact

While this vulnerability requires an attacker to first compromise the renderer process—a non-trivial step—successful exploitation leads to confidentiality loss. Organizations relying on ChromeOS for secure browsing face risk of credential theft, session hijacking, or exfiltration of sensitive work-related data if users visit malicious sites after their browser has been partially compromised. The indirect attack chain reduces immediate business risk, but the memory-disclosure nature makes it valuable in multi-stage attack scenarios targeting sensitive workflows.

Affected systems

Google Chrome and ChromeOS versions prior to 149.0.7827.115 are affected. The vulnerability is specific to the video processing component, so it is only triggered when processing video content. ChromeOS users are the primary target, though the vulnerability may also affect Chrome on other platforms running versions before 149.0.7827.115. Verify the exact patch version for your deployment against Google's official security advisory.

Exploitability

The attack requires a renderer process compromise as a prerequisite, which significantly constrains exploitability. An attacker must first get malicious code running in the renderer sandbox—achievable through other browser vulnerabilities, but not through this vulnerability alone. Once the renderer is compromised, exploitation is deterministic: a crafted HTML page triggers the out-of-bounds read. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been confirmed at the time of publication. The overall exploitability remains moderate due to the prerequisite compromise requirement.

Remediation

Update Chrome and ChromeOS to version 149.0.7827.115 or later. This patch addresses the out-of-bounds read by correcting buffer boundary handling in the video component. Organizations should prioritize this update for devices handling sensitive work, particularly those used for financial, healthcare, or legal workflows. Consider enabling automatic Chrome updates if not already configured, and audit device inventories to identify systems still running older versions.

Patch guidance

Install Chrome version 149.0.7827.115 or later, and ensure ChromeOS is updated to the corresponding build. Both automatic and manual update mechanisms are available; automatic updates are enabled by default on most ChromeOS devices. Organizations with managed device fleets should deploy this update through their device management platform (such as Google Admin Console) to ensure comprehensive coverage. Verify the update has taken effect by checking Chrome settings (chrome://settings/help) or ChromeOS system settings. No workarounds are available; patching is the only remediation.

Detection guidance

Monitor for Chrome and ChromeOS versions in your environment still running below 149.0.7827.115 using device inventory tools or endpoint detection and response (EDR) solutions. Watch for unusual video-processing behaviors or crashes in browser logs that might indicate exploitation attempts. On managed ChromeOS fleets, verify update compliance through the Google Admin Console. Memory forensics may reveal signs of out-of-bounds reads, though detection is complex without specific telemetry. Prioritize identification of unpatched systems over active detection, as real-world exploitation remains undocumented.

Why prioritize this

This vulnerability merits prompt but not emergency action. While the Chromium severity is High and the confidentiality impact is real, the prerequisite renderer compromise significantly raises the attack bar. Organizations using ChromeOS for general browsing can schedule the patch within their standard update cycle. However, teams managing high-value assets or sensitive intellectual property should treat this as higher priority due to the memory-disclosure potential in multi-stage attacks. The absence from the KEV catalog suggests this is not an active zero-day; standard patching timelines are appropriate.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network attack vector and low attack complexity balanced against the requirement for prior renderer compromise (no privileges required to trigger, but context-dependent). The score emphasizes confidentiality impact (High) with no integrity or availability loss. The gap between the Chromium High severity rating and the CVSS Medium score stems from the attack scenario: while the vulnerability itself is exploitable, it requires an attacker to have already breached the renderer sandbox, which the CVSS vector accounts for as a prerequisite context rather than a scored prerequisite.

Frequently asked questions