This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-13018 →

DEBIAN-CVE-2026-13018

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of b...

Original description

The description as published by the source.

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 chromium

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"147.0.7727.55-1~deb12u1"}]}]

Debian:13 chromium

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"147.0.7727.55-1~deb13u1"}]}]

Debian:14 chromium

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"147.0.7727.55-1"}]}]

References

advisory security-tracker.debian.org