CVE-2026-13018

NameCVE-2026-13018
DescriptionInsufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6205-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
chromium (PTS)bookworm150.0.7871.100-1~deb12u1fixed
bookworm (security)154.0.8037.57-1~deb12u1fixed
trixie150.0.7871.181-1~deb13u1fixed
trixie (security)154.0.8037.57-1~deb13u1fixed
forky, sid154.0.8037.57-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
chromiumsourcebookworm147.0.7727.55-1~deb12u1DSA-6205-1
chromiumsourcetrixie147.0.7727.55-1~deb13u1DSA-6205-1
chromiumsource(unstable)147.0.7727.55-1
Search for package or bug name: Reporting problems