Description

Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:17.297Z",
  "pubdate": "2026-08-25T21:18:17.297Z",
  "executiveSummary": "This vulnerability involves a buffer overflow flaw within the Media component of Google Chrome, affecting versions prior to 152.0.7977.65. The vulnerability is classified with a Medium security severity by Chromium maintainers. It allows a remote, unauthenticated attacker to execute arbitrary code within the constraints of the browser sandbox.\nThe exploitation of this flaw is achieved through the delivery of a specially crafted HTML page to a target user. Successful exploitation grants the attacker the ability to perform unauthorized operations within the sandboxed environment, potentially leading to security compromises or further exploitation chains. Because the vulnerability resides in the media processing logic, it poses a significant risk to users who browse malicious or compromised websites. The primary mitigation involves updating the browser to the patched version, which remediates the underlying memory safety issue.",
  "technicalDetails": "The root cause of this vulnerability is a buffer overflow condition located within the Media handling stack of the Chromium engine. A buffer overflow occurs when an application writes data beyond the allocated boundaries of a fixed-length buffer, potentially overwriting adjacent memory segments. In this specific case, the Media component fails to properly validate or sanitize the size of input data processed during media stream parsing or rendering.\nThe attack flow begins when a remote attacker hosts a malicious HTML page containing a crafted media payload. When a user navigates to the attacker-controlled page, the browser's Media component attempts to parse the malformed data. By carefully constructing the input, an attacker can trigger a heap-based or stack-based buffer overflow, allowing for the corruption of adjacent control data, such as function pointers or return addresses.\nThe vulnerability resides in the Media subsystem, which is responsible for decoding and processing various audio and video formats. Because this component is exposed to untrusted web content, it serves as a high-value target for exploitation. The Chromium sandbox is designed to restrict the impact of such memory corruption vulnerabilities by isolating the renderer process from the host operating system and sensitive user data. However, successful exploitation results in arbitrary code execution within the context of the sandboxed process.\nAuthentication is not required for exploitation, as the vulnerability is triggered automatically via standard web browsing activity. The attack requires no interaction beyond the user visiting the malicious URL. The exploit payload, once successfully injected into the memory space of the renderer process, allows the attacker to execute instructions in the context of the sandbox. Post-exploitation impact is limited by the sandbox's security boundaries, though it represents a critical failure in the memory safety of the Media pipeline, which may be chained with additional vulnerabilities—such as a sandbox escape—to achieve full system compromise. The issue affects all versions of Google Chrome prior to 152.0.7977.65."
}