Executive brief
A security vulnerability exists in Google Chrome's WebRTC component, which handles real-time communication like video and audio calls. By tricking a user into visiting a specially crafted website, an attacker could potentially execute unauthorized code on the user's computer. While this code would be confined within the browser's security sandbox, it could still lead to data theft or be used as a stepping stone for further attacks.
Technical details
A use-after-free (UAF) vulnerability exists in the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser attempts to access memory that has already been freed, typically during the processing of real-time communication streams. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website containing a crafted HTML page. Successful exploitation allows for arbitrary code execution (ACE) within the context of the Chromium sandbox. Google has addressed this issue in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-04-17: disclosed: Reported to the Chromium project by Google researchers.
- 2026-06-02: patched: Fixed in Chrome version 149.0.7827.53.
- 2026-06-04: advisory: CVE published in the NVD.