Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2615 articles · 111458 vulns · 36/41 feeds (7d)
← Back to list
8.8
CVE-2026-5292EXPLOITEDPATCHED
google · chrome

CVE-2026-5292: Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of

Description

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

Affected Products

VendorProductVersions
googlechrome146.0.7680.178

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
applemacoscve_cpe95%
googlechromecert_advisory90%
linuxlinux_kernelcve_cpe95%
microsoftwindowscve_cpe95%

References

  • https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html
  • https://issues.chromium.org/issues/492213293

Related News (6 articles)

Tier B
BSI Advisories1d ago
[NEU] [hoch] Google Chrome: Mehrere Schwachstellen
→ No new info (linked only)
Tier A
Microsoft MSRC14d ago
Chromium: CVE-2026-5292 Out of bounds read in WebCodecs
→ No new info (linked only)
Tier B
BSI Advisories16d ago
[NEU] [hoch] Google Chrome: Mehrere Schwachstellen
→ No new info (linked only)
Tier B
BSI Advisories16d ago
[UPDATE] [hoch] Google Chrome/Microsoft Edge: Mehrere Schwachstellen
→ No new info (linked only)
Tier B
BSI Advisories16d ago
[UPDATE] [hoch] Google Chrome und Microsoft Edge: Mehrere Schwachstellen
→ No new info (linked only)
Tier B
CERT-FR16d ago
Multiples vulnérabilités dans Google Chrome (01 avril 2026)
→ No new info (linked only)
CVSS 3.18.8 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
146.0.7680.177
CWECWE-125, CWE-20
PublishedApr 1, 2026
Last enriched14d agov2
Tags
code executiondenial of serviceinformation disclosuredata manipulationchromium
Trending Score60
Source articles6
Independent3
Info Completeness10/14
Missing: epss, kev, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-5873EXP
CVE-2026-5873: Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrar
Trending: 61
HIGHCVE-2026-6297EXP
CVE-2026-6297: Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to
Trending: 57
CRITICALCVE-2026-6298EXP
CVE-2026-6298: Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially se
Trending: 55
HIGHCVE-2026-6318EXP
CVE-2026-6318: Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code in
Trending: 54
HIGHCVE-2026-6316EXP
CVE-2026-6316: Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code ins
Trending: 54

Pin to Dashboard

Verification

State: verified
Confidence: 100%

Vulnerability Timeline

CVE Published
Apr 1, 2026
Discovered by ZDM
Apr 1, 2026
Actively Exploited
Apr 2, 2026
Exploit Available
Apr 2, 2026
Patch Available
Apr 2, 2026
Updated: exploitAvailable, activelyExploited, tags
Apr 2, 2026

Version History

v2
Last enriched 14d ago
v2Tier A14d ago

Updated vendor to Microsoft, added product Edge, marked exploit as available and actively exploited, and added new tag 'chromium'.

exploitAvailableactivelyExploitedtags
via Microsoft MSRC
v115d ago

Initial creation