CVE-2026-13018

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

• CWE-20

• https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
• https://issues.chromium.org/issues/487950074Permissions Required

Published

Sep 28, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1301In builds with PubSub and JSON enabled, a crafted JSON messa…6.8
• CVE-2026-13010The JoomSport – for Sports: Team & League, Football, Hockey …6.5
• CVE-2026-13011The ERP: Complete HR, Accounting & CRM Suite with Recruitmen…6.5
• CVE-2026-13014A vulnerability in Thales CERT "Suspicious" application =< 1…9.2
• CVE-2026-13015The Wp Google Places Review Slider plugin for WordPress is v…6.1
• CVE-2026-13016ServiceNow has remediated a SQL injection vulnerability that…9.3
• CVE-2026-13019Esri Portal for ArcGIS versions 12.1 and earlier on Windows,…9.8
• CVE-2026-1302The Meta-box GalleryMeta plugin for WordPress is vulnerable …4.4
• CVE-2026-13020A Weak Password Recovery Mechanism for Forgotten Password ex…9.8
• CVE-2026-13021Inappropriate implementation in DeviceBoundSessionCredential…4.3
• CVE-2026-13022Inappropriate implementation in Autofill in Google Chrome pr…6.5
• CVE-2026-13023Uninitialized Use in GPU in Google Chrome prior to 149.0.782…5.3