CVE-2026-7957
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An out of bounds write in Media in Google Chrome on Mac and iOS prior to version 148.0.7778.96 allows a remote attacker who has compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
Risk Assessment
This vulnerability could lead to the execution of malicious code within the sandbox environment, posing a risk to user data security and system integrity.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and reduce the risk of attacks.
Other vulnerabilities in Google Chrome Media
See all- CVE-2026-12462High
A use after free vulnerability in Media in Google Chrome prior to version 149.0.7827.155 allows a remote attacker who has compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2023-3421High
A use after free vulnerability in Media in Google Chrome prior to version 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Original NVD description (English source)
Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS