Chrome · Chromium
CVE-2026-1861
OOB in Chromium
Overview
High
Severity
—
CVSS
No
Exploited ITW
Embargoed
Fix Status
Fix not yet public
No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.
Original Bug Report
reported by wt...@google.com
libvpx:vpx_enc_fuzzer_vp9: Heap-buffer-overflow in vpx_wb_write_literal
Security Bug
VULNERABILITY DETAILS This bug was originally reported in https://g-issues.oss-fuzz.com/issues/476466137: libvpx:vpx_enc_fuzzer_vp9: Heap-buffer-overflow in vpx_wb_write_literal
The write_superframe_index() function in vp9/vp9_cx_iface.c should return the number of bytes written. But if the output buffer is full and write_superframe_index() doesn’t write the optional superframe index, it still returns the size of the superframe index in bytes. It should return 0 in that case.
VERSION Chrome Version: 144.0.7559.96 stable Operating System: All
REPRODUCTION CASE See https://g-issues.oss-fuzz.com/issues/476466137.
References
On This Page