Executive brief
A vulnerability exists in Google Chrome's WebRTC component, which handles real-time communication like video and audio calls. By tricking a user into visiting a specially crafted website, a remote attacker could execute unauthorized code within the browser's security sandbox. While the sandbox provides a layer of protection, this flaw could lead to service instability or be used as part of a larger attack to compromise the user's system.
Technical details
A use-after-free (UAF) vulnerability exists in the WebRTC component of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser attempts to access memory that has already been freed, typically during the processing of real-time media streams or data channels. An attacker can exploit this by hosting a malicious HTML page that, when visited by a user, triggers the memory corruption. Successful exploitation allows for arbitrary code execution (ACE) within the context of the Chrome renderer sandbox. Users are advised to update to version 149.0.7827.53 or later to mitigate this risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11118 published.