PatchGap
Chrome · Chromium

CVE-2026-1861

OOB in Chromium
High CVSS 8.8 chrome OOB 📄 Reporter bug report

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Embargoed
Fix Status
ImpactHeap buffer overflow in libvpx
DescriptionHeap buffer overflow in libvpx
ComponentChromium
Bug ClassOOB
Tracker478942410
CWECWE-122, CWE-787 (Heap buffer overflow, Out-of-bounds write)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedGoogle
Reported2026-01-26 (per vendor advisory)
Disclosed2026-02-03

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.

Original Bug Report

reported by wt...@google.com

libvpx:vpx_enc_fuzzer_vp9: Heap-buffer-overflow in vpx_wb_write_literal

Security Bug

VULNERABILITY DETAILS This bug was originally reported in https://g-issues.oss-fuzz.com/issues/476466137: libvpx:vpx_enc_fuzzer_vp9: Heap-buffer-overflow in vpx_wb_write_literal

The write_superframe_index() function in vp9/vp9_cx_iface.c should return the number of bytes written. But if the output buffer is full and write_superframe_index() doesn’t write the optional superframe index, it still returns the size of the superframe index in bytes. It should return 0 in that case.

VERSION Chrome Version: 144.0.7559.96 stable Operating System: All

REPRODUCTION CASE See https://g-issues.oss-fuzz.com/issues/476466137.

View on issue tracker
Links in the report
On This Page