CVE-2026-8535
published 2026-05-14CVE-2026-8535: Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process…
PriorityP427medium5.3CVSS 3.1
AVNACHPRNUIRSUCHINAN
EPSS
0.19%
8.8th percentile
Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted JPEG file. (Chromium security severity: High)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 148.0.7778.168 | 148.0.7778.168 | |
| chrome | >= 148.0.7778.168 < 148.0.7778.168 | 148.0.7778.168 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
vendor_paloalto·2026-06-10·CVSS 8.8
CVE-2026-8509 [HIGH] PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html CVE Summary CVE-2026-8509 Heap buffer overflow in WebML CVE-2026-8510 Integer overflow in Skia CVE-2026-8511 Use after free in UI CVE-2026-8512 Use after free in FileSystem CVE-2026-8513 Use after free in Input CVE-2026-8514 Use after free in Aura CVE-2026-8515 Use after free
Red Hat
chromium-browser: chromium-browser: Out of bounds read in Media
vendor_redhat·2026-05-14·CVSS 5.3
CVE-2026-8535 [MEDIUM] CWE-125 chromium-browser: chromium-browser: Out of bounds read in Media
chromium-browser: chromium-browser: Out of bounds read in Media
An out of bounds read flaw was found in the Media component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=495530312
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-8535
vendor_chrome·2026-05-12·CVSS 5.3
CVE-2026-8535 [HIGH] Stable Channel Update for Desktop: CVE-2026-8535
Stable Channel Update for Desktop
CVE-2026-8535: Out of bounds read in Media. Reported by Google on 2026-03-23 [N/A][ 495857582 ] High CVE-2026-8536: Insufficient validation of untrusted input in ReadingMode
Reported by Google on 2026-03-24 [N/A][ 495890000 ] High CVE-2026-8537: Insufficient policy enforcement in ViewTransitions
Severity: high
Chrome
Stable Channel Update for Desktop: CVE-2026-8534
vendor_chrome·2026-05-12·CVSS 8.3
CVE-2026-8534 [HIGH] Stable Channel Update for Desktop: CVE-2026-8534
Stable Channel Update for Desktop
CVE-2026-8534: Integer overflow in GPU. Reported by Google on 2026-03-23 [N/A][ 495530312 ] High CVE-2026-8535: Out of bounds read in Media
Reported by Google on 2026-03-23 [N/A][ 495857582 ] High CVE-2026-8536: Insufficient validation of untrusted input in ReadingMode
Severity: high
GHSA
GHSA-cx47-c55q-jxc3: Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148
ghsa_unreviewed·2026-05-14
CVE-2026-8535 [MEDIUM] CWE-125 GHSA-cx47-c55q-jxc3: Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148
Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted JPEG file. (Chromium security severity: High)
GHSA
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
ghsa·2026-02-11
CVE-2026-26010 [HIGH] CWE-269 Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
### Summary
Calls issued by the UI against `/api/v1/ingestionPipelines` leak JWTs used by `ingestion-bot` for certain services (Glue / Redshift / Postgres)
### Details
Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies).
### PoC
I was able to extract the JWT used by the bot/agent populating [sample_athena.default](https://sandbox.open-metadata.org/database/sample_athena.default) in the Collate Sandbox. To prove this out, I mutated the description to this UUID: `fe2e4cc1-da72-4acf-8535-112a3cfa9c
No detection rules found.
No public exploits indexed.
2026-05-14
Published