CVE-2026-13858: Out-of-Bounds Memory Read in Chrome FFmpeg (Medium Severity)

Technical summary

CVE-2026-13858 is an out-of-bounds read vulnerability (CWE-125) in FFmpeg's video processing logic as integrated into Chromium. The flaw allows an attacker to craft a video file that, upon parsing and decoding, causes FFmpeg to read memory outside its intended buffer. This memory disclosure can leak sensitive information such as authentication tokens, cryptographic material, or other process secrets. The vulnerability is reachable via the network (AV:N), requires no elevated privileges (PR:N), and has low attack complexity (AC:L), but does require user interaction to open the malicious file (UI:R). The impact is limited to confidentiality; integrity and availability of the system are unaffected.

Business impact

While the vulnerability cannot crash Chrome or enable code execution, the information disclosure risk is material. Users who open untrusted video files or visit compromised websites hosting malicious media could have sensitive session data, passwords stored in memory, or other credentials exposed. Organizations heavily reliant on Chrome for accessing sensitive applications should treat this as a privacy and data loss risk, particularly if browser memory may contain temporary secrets or unencrypted customer data. The attack surface is broad because video content is ubiquitous and users often trust media from seemingly legitimate sources.

Affected systems

Google Chrome releases prior to version 150.0.7871.47 are vulnerable. This includes Chrome on Windows, macOS, Linux, Android, and iOS platforms. Chromium-based browsers that incorporate the vulnerable FFmpeg version may also be affected; verify vendor patch status independently. Users on automatic update should receive the fix without manual intervention, but those on managed or deferred update channels require explicit deployment.

Exploitability

Exploitation is relatively low-friction. An attacker needs only to craft a malicious video file and host it where a target user will download or view it—via phishing, compromised website, or even a social engineering message. No browser vulnerabilities or tricks are needed; opening the file in Chrome is sufficient. Public exploit code is not known to exist as of the published date, but the straightforward nature of the bug (an out-of-bounds read in a parser) means that proof-of-concept development is feasible for skilled attackers. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation has not been widely observed at publication.

Remediation

Update Chrome to version 150.0.7871.47 or later. For Chrome on desktop (Windows, macOS, Linux), enable automatic updates or manually navigate to Settings > About Chrome to trigger an update check. Mobile users (iOS, Android) should update via their respective app stores. In enterprise environments, deploy via your MDM or Chrome update policy. For organizations that cannot immediately patch, restrict opening of video files from untrusted sources and consider blocking video previews in email clients or file-sharing platforms.

Patch guidance

Upgrade to Chrome 150.0.7871.47 or any subsequent stable release. Verify the update by checking Chrome Settings > About Chrome; the version number will display and auto-update will confirm completion. For enterprise deployments, consult Google's Chrome release notes and update your policy group settings if using Chrome Enterprise. No workarounds are available short of avoiding untrusted video content; patching is the only remediation.

Detection guidance

Network-level detection is limited because the exploit is a crafted video file. Endpoint detection should focus on unusual memory access patterns or crashes in Chrome's FFmpeg process (if debugging/profiling is enabled), but these are unlikely to be visible in standard EDR logs. Browser isolation solutions or sandboxing can help contain the impact by executing video decoding in a restricted process. Monitor for suspicious video files in email and web traffic; files with obfuscated headers or anomalous codec metadata warrant scrutiny. Once patched, Chrome will safely reject or process the malicious file without leaking memory.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the practical risk is elevated by the low user interaction barrier and broad attack surface. Information disclosure vulnerabilities are often underestimated; leaked memory can contain session tokens, API keys, or other secrets that enable lateral movement or account compromise. Organizations handling sensitive data or operating in regulated industries should prioritize this patch. The 4-6 week window between publication (2026-06-30) and typical enterprise patch cycles makes early action important.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the high confidentiality impact (user memory exposure) tempered by the requirement for user interaction and lack of integrity or availability impact. The network-accessible attack vector and low complexity elevate the score; the user interaction requirement prevents a higher rating. In contexts where users frequently open untrusted media or where leaked memory could contain high-value secrets, the real-world risk may exceed the numerical score.

Frequently asked questions