Executive brief
A security vulnerability exists in Google Chrome for Android within the WebMIDI component, which handles connections to musical instruments. An attacker who has already partially compromised the browser's rendering process could use this flaw to escape the security 'sandbox' that normally keeps web content isolated from the rest of the device. If successful, this could allow an attacker to gain broader access to the user's device and data.
Technical details
A use-after-free (UAF) vulnerability exists in the WebMIDI implementation of Google Chrome for Android. The flaw is triggered when the browser incorrectly manages memory for MIDI device interfaces, allowing a remote attacker who has already compromised the renderer process to execute arbitrary code outside of the browser's sandbox. Exploitation typically requires the victim to navigate to a specially crafted HTML page. This vulnerability was addressed in version 148.0.7778.216.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Fixed in Chrome version 148.0.7778.216
- 2026-05-28: disclosed