Medium · 4.3 CVE-2026-13018 EUVD-2026-88441GHSA-w262-r7rm-rmgm

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perfo…

Published Sep 28, 2026 · Updated Sep 28, 2026 · Assigned by Chrome

Vendor: Google Product: Chrome Package: chromium Category: Browsers Ecosystem: Debian

Description

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

Affected products

Vendor	Product	Affected	Fixed
Google	Chrome	147.0.7727.55 – < 147.0.7727.55	147.0.7727.55

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	chromium	147.0.7727.55-1	—
Debian 13	chromium	147.0.7727.55-1~deb13u1	—
Debian 12	chromium	147.0.7727.55-1~deb12u1	—