CVE-2026-1861CWE-122

Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…

High · published February 3, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

⚡ A crafty HTML page can turn into a digital minefield due to a heap buffer overflow in libvpx! This flaw in Google Chrome prior to version 144.0.7559.132 could give attackers a sneaky way in! 🔥 Think of it like an overflowing bathtub: a little water spilling over isn't a huge deal, but if someone keeps pouring in more, it can cause a cascading disaster! Just like that, this vulnerability could lead to heap corruption if exploited, overflowing with potential risks. An attacker could potentially exploit this by luring users to view a malicious page, leading to unauthorized access or even control over the affected system. It's a high-stakes game where a simple click could lead to chaos!

Put simply

Think of it like an overflowing bathtub: a little water spilling over isn't a huge deal, but if someone keeps pouring in more, it can cause a cascading disaster! Just like that, this vulnerability could lead to heap corruption if exploited, overflowing with potential risks. This heap buffer overflow vulnerability occurs in libvpx, a video codec library used in Chrome, allowing attackers to overwrite memory regions through specially crafted HTML pages, leading to heap corruption.

What to do

An attacker could potentially exploit this by luring users to view a malicious page, leading to unauthorized access or even control over the affected system. It's a high-stakes game where a simple click could lead to chaos! Upgrade Google Chrome to version 144.0.7559.132 or later immediately to close this vulnerability. Regularly update your browser and avoid visiting untrusted sites to minimize risks. You’ve got this! Stay proactive with your updates, and you’ll keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-02-03T20:56Z
EPSS history
Timeline
  • 03 FEB 20:56Z
    Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
    cvelistv5