CVE-2026-12033

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
GoogleChrome>= 149.0.7827.115, < 149.0.7827.115

References

Timeline

Published
Jun 11, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1203307.1Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recCVE-2026-1203315.3Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend usCVE-2026-1203325.1The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inCVE-2026-1203338.8The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests withCVE-2026-1203344.3A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modelingCVE-2026-1203354.8A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/langCVE-2026-1203367.3A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDCVE-2026-1203377.3A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperICVE-2026-12033810.0Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The featCVE-2026-1203394.3A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedeCVE-2026-120348.3Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacCVE-2026-1203403.7A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Globa