Out-of-Bounds Write in Google Chrome Codecs

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Chrome

Description

Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-16807

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 150.0.7871.186 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out of bounds write vulnerability in the Codecs component of Google Chrome versions before 150.0.7871.186. It allows a remote attacker to execute arbitrary code by exploiting a flaw in how Chrome processes crafted HTML pages, potentially leading to a sandbox escape.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system, bypass security restrictions, or install malware. It may lead to unauthorized access to sensitive data or control of your device.

Mitigation Strategies

Update Google Chrome to version 150.0.7871.186 or later to address the out of bounds write vulnerability in Codecs.

Hi! I’m here to help you understand CVE-2026-16807. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70