Executive brief
A vulnerability in Google Chrome's media processing components could allow a malicious website to access sensitive information from the browser's memory. This occurs when a user visits a specially crafted webpage, potentially leading to the exposure of private data from other open tabs or browser processes. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
A use-after-free (UAF) vulnerability exists in the Codecs component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the processing of media content via a crafted HTML page. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, leading to an out-of-bounds memory access. This can result in the disclosure of sensitive information from the process memory. The issue is addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome stable channel update released
- 2026-06-04: disclosed: NVD publication date