CVE-2015-1258: Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit...

Security readout for executives and security teams

This is an older Chrome media-processing flaw involving VP9 video. A specially crafted video frame could make Chrome mishandle a size value, causing a crash and possibly other unspecified impact. The bundle does not provide CVSS, confirmed exploitation, or detailed downstream package scope. Primary exposure is legacy Google Chrome before 43.0.2357.65 processing VP9 video data. The referenced distribution advisories suggest downstream libvpx package relevance, but this bundle does not provide exact affected distro package versions. Medium priority for normal environments because this is old and not KEV-listed. Raise priority if legacy browsers or unpatched libvpx packages remain in environments that process untrusted media. Mitigation focus: Upgrade Chrome to 43.0.2357.65 or later where still applicable.; Apply relevant vendor libvpx updates from OS distribution advisories.; Retire unsupported legacy Chrome builds from managed endpoints..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.