AI Agent Finds 21 FFmpeg Zero-Days as Chrome 149 Fixes Record 429 Bugs

Summary

An autonomous agent reported 21 confirmed FFmpeg zero-days, including flaws up to 23 years old, while Chrome 149 patched a record 429 bugs. The article urges rapid updates, including bundled FFmpeg copies.

Key points

Security startup depthfirst said its autonomous agent found 21 confirmed FFmpeg zero-days and produced reproducible proof-of-concept inputs.
Several FFmpeg flaws had reportedly remained undiscovered for 15 to 23 years; many are overflows in parsers and demuxers.
Google Chrome 149 fixed 429 security bugs, a record for one release; the article says more than 100 were critical or high severity.
CVE-2026-10881, an out-of-bounds read and write in ANGLE, could let a crafted page escape the sandbox and execute code on the host, according to the article.
Google has not linked Chrome’s record bug count to AI; the article attributes the connection to a broader increase in AI-generated vulnerability reports.
The article recommends updating FFmpeg and Chrome promptly, including FFmpeg copies bundled in applications, containers, and appliances.

Article Details

Event Type: AI-assisted discovery of zero-day vulnerabilities in FFmpeg and a record security patch release for Chrome 149.
Impact: Twenty-one previously unknown FFmpeg vulnerabilities were confirmed, including long-standing parser and demuxer overflows; several have CVE identifiers and the others were reported fixed but not yet numbered. Chrome 149 patches 429 security bugs. CVE-2026-10881 in ANGLE could allow a crafted page to escape the sandbox and execute code on the host. The article recommends promptly updating FFmpeg, including embedded copies, and Chrome.