Executive brief
A vulnerability in Google Chrome's WebRTC component, which handles real-time communication like video and audio calls, could allow an attacker to execute malicious code on a user's computer. This occurs if a user visits a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized access to browser data or serve as a stepping stone for further system compromise.
Technical details
This vulnerability is a use-after-free (CWE-416) located within the WebRTC component of Google Chrome. The flaw is triggered when the browser attempts to access memory that has already been deallocated, typically during the processing of media streams or communication protocols. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website containing a crafted HTML page. Successful exploitation allows for arbitrary code execution (ACE) within the context of the Chromium sandbox. Google has addressed this issue in version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-04-17: disclosed: Reported by researcher c6eed09fc8b174b0f3eebedcceb1e792
- 2026-06-02: patched: Fixed in Chrome 149.0.7827.53 stable channel update
- 2026-06-04: advisory: NVD publication date