{"id":1196,"date":"2026-06-06T08:37:29","date_gmt":"2026-06-06T08:37:29","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1196"},"modified":"2026-06-06T08:37:29","modified_gmt":"2026-06-06T08:37:29","slug":"ai-agent-uncovers-21-zero-days-in-ffmpeg-chrome-patches-record-429-bugs","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1196","title":{"rendered":"AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Jun 06, 2026<\/span><\/span>Vulnerability \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Two things landed within days of each other this week. A security startup reported 21 previously unknown vulnerabilities in FFmpeg, the media library inside almost everything that touches video, all of them found by an autonomous AI agent.<\/p>\n

The same week, Google shipped Chrome 149<\/a> with patches for 429 security bugs, the most ever in a single release.<\/p>\n

Only the FFmpeg bugs were found by AI. Chrome’s record landed after Google overhauled its bounty program to cope with a flood of AI-generated reports. The mechanisms differ, but the pressure is the same: AI is putting more vulnerabilities in front of the people who have to deal with them, and faster than before.<\/p>\n

The FFmpeg findings come from depthfirst<\/a>, whose autonomous security agent scanned the project’s roughly 1.5 million lines of C and produced 21 confirmed zero-days, each with a reproducible proof-of-concept input.<\/p>\n

The company puts the cost of the run at around $1,000. Several of the bugs had been latent for 15 to 20 years; one stack overflow in the service-description-table code dates to 2003 and sat untouched for 23 years.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Most are heap or stack overflows in parsers and demuxers, spanning components from the TS demuxer to the VP9 decoder. depthfirst says some already carry CVE identifiers; its writeup lists nine, CVE-2026-39210 through CVE-2026-39218, and notes the rest are fixed but not yet numbered. It also published a PoC<\/a>.<\/p>\n

<\/p>\n

In separate news, Chrome 149 fixes 429 vulnerabilities, a record for a single release. Over 100 are critical or high severity, mostly use-after-free and insufficient input validation.<\/p>\n

The worst, CVE-2026-10881 (CVSS 9.6), is an out-of-bounds read and write in the ANGLE graphics engine that lets a crafted page escape the sandbox and run code on the host. Google paid $97,000 for it.<\/p>\n

The highest-severity bugs were mostly internal finds: of roughly 90 high-severity bugs, only 10 came from outside researchers, and 19 of the 22 critical ones were Google’s own. The AI connection is more about volume than authorship.<\/p>\n

Google hasn’t tied the 429 to AI; the on-record signal is the bounty overhaul<\/a> it made in April, prompted by a flood of AI-generated submissions and now asking for a concise reproducer over the long writeups AI churns out.<\/p>\n

Google’s Big Sleep agent reported a run of FFmpeg bugs last year, now visible on the project’s security page<\/a> tagged BIGSLEEP, and Anthropic’s Mythos model pulled a 16-year-old H.264 flaw and others out of FFmpeg for about $10,000, three of which shipped in FFmpeg 8.1, per its own writeup<\/a>.<\/p>\n

Days ago, another autonomous tool found an authenticated RCE in Redis that had been present since version 7.2.0, unnoticed for over two years. The research points the same way: a February study had an agent reproduce working PoCs for more than half of 100 real Linux kernel N-day bugs<\/a>, beating fuzzing.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

For FFmpeg, pull the fixed upstream build or your distribution’s security update as soon as it lands, and prioritize anything that ingests untrusted RTSP or AV1-over-RTP. FFmpeg is widely bundled in media pipelines, Python wheels, container images, and appliances, so do not stop at system packages; those embedded copies need patching too.<\/p>\n

For Chrome, update to 149.0.7827.53 on Linux or 149.0.7827.53\/54 on Windows and macOS, or confirm auto-update has run.<\/p>\n

The response has to match the new pace: shorter patch cycles, auto-update wherever it exists, and dependency bumps that carry CVE fixes treated as security work, not routine maintenance.<\/p>\n

The hard part is shifting, though. Finding these bugs has gotten cheap; triaging the reports, shipping the fixes, and getting them installed has not, and much of that work still falls to volunteers and a thin layer of human triagers now expected to keep pace with machines.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Swati Khandelwal\ue802Jun 06, 2026Vulnerability \/ Endpoint Security Two things landed within days of each other this week. A security startup reported 21 previously unknown vulnerabilities in FFmpeg, the media library…<\/p>\n","protected":false},"author":1,"featured_media":1197,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[683,809,182,1938,57,781,1937,53],"class_list":["post-1196","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-agent","tag-bugs","tag-chrome","tag-ffmpeg","tag-patches","tag-record","tag-uncovers","tag-zerodays"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1196"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1196\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1197"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}