CVE-2026-12019: Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149

Synopsis

A heap buffer overflow exists in the Codecs component of Google Chrome on Linux and ChromeOS prior to version 149.0.7827.115. The vulnerability is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page; exploit reliability is reduced by high attack complexity conditions. Successful exploitation allows the attacker to escape the Chrome sandbox, gaining the ability to read, modify, or destroy data and processes outside the browser's sandboxed environment. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving or directing the target to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is required to deliver the malicious page to the victim.

• Victim interactionRequired

  The victim must open or navigate to a crafted HTML page, requiring a social-engineering step to direct user action.

• Attack complexityDetail

  Exploit reliability is reduced because the attacker must have already compromised the Chrome renderer process before leveraging this overflow for a sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• An attacker who succeeds reads data accessible outside the Chrome sandbox, including files and credentials on the host system.
• The attacker can modify files, configuration, or persistent data on the underlying Linux or ChromeOS host beyond the browser process.
• The attacker can crash or disrupt processes outside the browser sandbox, affecting host-level service availability.
• Sandbox escape enables arbitrary code execution at the privilege level of the Chrome process user on the host.