CVE Catalog
CVE-2026-11668
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.03%
7th percentile - higher than 7% of all known CVEs
Summary
In Google Chrome on Linux and ChromeOS prior to version 149.0.7827.103, there is an uninitialized use issue in codecs that allows a remote attacker to leak cross-origin data via a crafted video file.
Risk Assessment
An attacker could gain access to sensitive user data, posing a serious threat to the privacy and security of the organization.
Recommendation
It is recommended to update Google Chrome to version 149.0.7827.103 or later to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
Uninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted video file. (Chromium security severity: High)