Skip to main content
Apexward Pulse

Google

Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory…

CVE-2026-126907

What this means

This is rated low severity (3.1 out of 10). There is no confirmed exploitation of it yet. Ask IT whether Google Chrome and Microsoft Windows are in your estate.

Full vendor description

Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Scoring and exploitation

3.1/ 10
CVSS 3.1 base scoreLow

Exploitable over the network without any account, under specific conditions, but only if a user takes an action, such as opening a file or link. Low impact on confidentiality.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityHighAC:H
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityLowC:L
IntegrityNoneI:N
AvailabilityNoneA:N
~0.2% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Not confirmed in the
Not reported

Weaknesses

CWE-908

Affected products ()

  • Google Chrome
  • Microsoft Windows
Show the raw CPE strings (2)
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

References

2 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events