CVE-2026-13858
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile — higher than 16% of all known CVEs
Summary
An out-of-bounds read vulnerability in FFmpeg within Google Chrome prior to version 150.0.7871.47 allows a remote attacker to read sensitive information from process memory by crafting a malicious video file.
Risk Assessment
The risk involves potential leakage of confidential data from browser memory, such as passwords or encryption keys, when a user is tricked into opening a crafted video file.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)