Executive brief
A vulnerability in Google Chrome's media handling component could allow a malicious website to execute unauthorized code on a user's computer. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized data access or serve as a stepping stone for further system compromise. Users are protected by updating to the latest version of the Chrome browser.
Technical details
A use-after-free (UAF) vulnerability exists in the Media component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the processing of media content, allowing a remote attacker to induce a memory corruption state. By convincing a user to visit a specially crafted HTML page, an attacker can exploit this condition to execute arbitrary code. Although the execution is restricted within the Chromium sandbox, this vulnerability (CWE-416) represents a significant security risk that could be chained with other exploits. The issue is resolved in Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 promoted to stable channel.
- 2026-06-04: disclosed: CVE-2026-11130 published.