Chrome · Video
CVE-2026-118313
UAF in Video
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/libaom/source/config/config/aom_version.hthird_party/libaom/README.chromiumthird_party/libaom/source/libaomDEPS
Patch
From 7b4f32d66fce2286a941dae942212190b7b913e0 Mon Sep 17 00:00:00 2001
From: Marco Paniconi <marpan@google.com>
Date: Thu, 22 Oct 2026 12:23:25 -0700
Subject: [PATCH] Cherry-pick libaom 016144ea8b8b to m156
https://aomedia.googlesource.com/aom.git/+log/7b6197cb8fdc..016144ea8b8b
Bug: 574032795
Change-Id: I93110593355fcf6d511dd2c1f37bae2fb3d7aefa
Fixed: 576122596
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8616029
Reviewed-by: Wan-Teh Chang <wtc@google.com>
Reviewed-by: Marco Paniconi <marpan@google.com>
Commit-Queue: Wan-Teh Chang <wtc@google.com>
Cr-Commit-Position: refs/branch-heads/8078@{#1447}
Cr-Branched-From: c50edc4214d81e4f944c3415d55104a49e46d214-refs/heads/main@{#1706539}
---
diff --git a/third_party/libaom/README.chromium b/third_party/libaom/README.chromium
index e8ba72d..113b3bf8e 100644
--- a/third_party/libaom/README.chromium
+++ b/third_party/libaom/README.chromium
@@ -2,7 +2,7 @@
Short Name: libaom
URL: https://aomedia.googlesource.com/aom/
Version: N/A
-Revision: 7b6197cb8fdc1ce555a03d23a9d25242c61d38e6
+Revision: 016144ea8b8b84b9cfa1c3fba56227b2d3471229
Update Mechanism: Manual
CPEPrefix: cpe:/a:aomedia:aomedia:3.15.1
License: Alliance-for-Open-Media-Patent, BSD-2-Clause
diff --git a/third_party/libaom/source/config/config/aom_version.h b/third_party/libaom/source/config/config/aom_version.h
index 05f17b20..7a24157 100644
--- a/third_party/libaom/source/config/config/aom_version.h
+++ b/third_party/libaom/source/config/config/aom_version.h
@@ -14,9 +14,9 @@
#define VERSION_MAJOR 3
#define VERSION_MINOR 15
#define VERSION_PATCH 1
-#define VERSION_EXTRA "50-g7b6197cb8f"
+#define VERSION_EXTRA "51-g016144ea8b"
#define VERSION_PACKED \
((VERSION_MAJOR << 16) | (VERSION_MINOR << 8) | (VERSION_PATCH))
-#define VERSION_STRING_NOSP "3.15.1-50-g7b6197cb8f"
-#define VERSION_STRING " 3.15.1-50-g7b6197cb8f"
+#define VERSION_STRING_NOSP "3.15.1-51-g016144ea8b"
+#define VERSION_STRING " 3.15.1-51-g016144ea8b"
#endif // AOM_VERSION_H_
diff --git a/third_party/libaom/source/libaom b/third_party/libaom/source/libaom
index 7b6197cb..016144e 160000
--- a/third_party/libaom/source/libaom
+++ b/third_party/libaom/source/libaom
@@ -1 +1 @@
-Subproject commit 7b6197cb8fdc1ce555a03d23a9d25242c61d38e6
+Subproject commit 016144ea8b8b84b9cfa1c3fba56227b2d3471229
diff --git a/DEPS b/DEPS
index 60b37553..4326d857 100644
--- a/DEPS
+++ b/DEPS
@@ -2564,7 +2564,7 @@
Var('chromium_git') + '/external/libaddressinput.git' + '@' + '81eb9628382b07d371d8ea0b11badf7de3857fd5',
'src/third_party/libaom/source/libaom':
- Var('aomedia_git') + '/aom.git' + '@' + '7b6197cb8fdc1ce555a03d23a9d25242c61d38e6',
+ Var('aomedia_git') + '/aom.git' + '@' + '016144ea8b8b84b9cfa1c3fba56227b2d3471229',
'src/third_party/crabbyavif/src':
Var('chromium_git') + '/external/github.com/webmproject/CrabbyAvif.git' + '@' + Var('crabbyavif_revision'),
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page