CVE-2026-13858: Google Chrome Information Disclosure Flaw

CVE-2026-13858 Overview

CVE-2026-13858 is an out-of-bounds read vulnerability in the FFmpeg media handling component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can trigger the flaw by delivering a crafted video file to a target user. Successful exploitation leaks potentially sensitive information from the browser process memory. Google classifies the Chromium security severity as Medium and requires user interaction to load the malicious media. The issue is tracked as [CWE-125] and was addressed in the Chrome Stable channel update.

Critical Impact
Remote attackers can read adjacent process memory through a crafted video file, exposing sensitive data such as tokens, URLs, or cached credentials rendered in the same address space.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers embedding the vulnerable FFmpeg build
Desktop Chrome distributions across Windows, macOS, and Linux

Discovery Timeline

2026-06-30 - CVE-2026-13858 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13858

Vulnerability Analysis

The vulnerability resides in the FFmpeg library bundled with Chrome, which the browser uses for decoding audio and video content across HTML5 media elements and WebCodecs. An out-of-bounds read [CWE-125] occurs when the decoder processes a specifically malformed video stream, causing it to reference memory outside the intended buffer boundaries. The attack requires user interaction, meaning the victim must load a page or open content that triggers the affected decoder path. Because Chrome renders untrusted media routinely, an attacker only needs to place the crafted file on a site the victim visits or embed it in a page.

Root Cause

The root cause is missing or insufficient bounds validation within an FFmpeg demuxer or decoder routine when parsing container metadata or frame data. Crafted field values in the video stream drive read offsets past the allocated buffer, returning uninitialized or adjacent heap contents to caller logic. Sandbox boundaries limit but do not eliminate the exposure, since sensitive tab and session data can share the renderer or utility process address space.

Attack Vector

Exploitation is network-based. The attacker hosts or delivers a crafted video file, then lures the target to load it in Chrome. The browser invokes FFmpeg to decode the media, which reads out-of-bounds bytes and may expose that data through side channels such as canvas readback, rendering artifacts, or WebCodecs error paths. See the Chromium Issue Tracker #507090179 for the tracked component.

No public exploit code or proof-of-concept has been observed for this issue.

Detection Methods for CVE-2026-13858

Indicators of Compromise

Chrome renderer or utility process crashes correlating with media playback on untrusted origins
Unexpected outbound requests for video files with unusual container structures (.mp4, .webm, .mkv) from user browsing sessions
Browser telemetry showing FFmpeg decoder faults or memory sanitizer warnings on managed endpoints

Detection Strategies

Inventory Chrome versions across the fleet and flag any host running a build earlier than 150.0.7871.47
Inspect proxy and web gateway logs for video downloads from low-reputation domains preceding renderer crashes
Correlate endpoint process telemetry for chrome.exe utility process termination events with concurrent media MIME types

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize crash and version data
Feed browser and endpoint telemetry into a SIEM for cross-correlation with web traffic
Alert on repeated renderer or GPU process crashes on the same host within short time windows

How to Mitigate CVE-2026-13858

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force restart of the browser to complete the update, since Chrome patches only apply after relaunch
Audit Chromium-derived browsers and embedded frameworks for updated FFmpeg builds

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for release notes and channel details. Administrators using Chrome Enterprise should push the update through group policy or the Chrome Browser Cloud Management console.

Workarounds

Restrict video playback from untrusted origins using enterprise policies such as URLBlocklist
Deploy web content filtering to block downloads of media from uncategorized or low-reputation domains
Disable autoplay and pre-fetching of media content until patching completes

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Example Chrome Enterprise policy fragment to blocklist risky origins
# /etc/opt/chrome/policies/managed/media_blocklist.json
{
  "URLBlocklist": [
    "*://untrusted.example/*"
  ]
}