Executive brief
A vulnerability in Google Chrome's WebRTC component, which handles real-time communication like video and audio calls, could allow a malicious website to execute unauthorized code on a user's computer. While the attack is limited by Chrome's security sandbox, it could still lead to data exposure or serve as a stepping stone for further system compromise. Users should update to the latest version of Chrome to protect themselves.
Technical details
A use-after-free (UAF) vulnerability exists in the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser incorrectly manages memory during the processing of real-time communication streams. A remote attacker can exploit this by enticing a user to visit a maliciously crafted HTML page, leading to memory corruption. Successful exploitation allows for arbitrary code execution (ACE) within the context of the Chromium sandbox. Google has addressed this issue in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11054 published.