Executive brief
A vulnerability in Google Chrome's audio processing component could allow a malicious website to execute unauthorized code on a user's computer. While the attack is limited by Chrome's internal security sandbox, it could lead to data theft or further system compromise if combined with other flaws. Users are protected by updating to the latest version of the browser.
Technical details
A race condition (CWE-362) exists in the WebAudio implementation of Google Chrome. By enticing a user to visit a malicious website, a remote attacker can exploit improper synchronization during concurrent execution to trigger memory corruption. This allows for arbitrary code execution (ACE) within the context of the renderer process sandbox. The vulnerability is resolved in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released
- 2026-05-28: disclosed: CVE published