Executive brief
A vulnerability exists in Google Chrome's WebRTC component, which handles real-time communication like video and voice calls. By tricking a user into visiting a specially crafted website, an attacker could potentially execute malicious code on the user's computer. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized actions or be used as part of a larger attack chain to compromise the system.
Technical details
A use-after-free (UAF) vulnerability exists in the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser incorrectly manages memory during the processing of WebRTC content, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious website, a remote attacker can exploit this condition to achieve arbitrary code execution (ACE) within the context of the Chromium sandbox. This vulnerability is tracked as CWE-416. Users are advised to update to version 149.0.7827.53 or later to mitigate this risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11003 published.