Executive brief
Google Chrome, a widely used web browser, contains a security vulnerability in its WebAudio component, which handles audio processing for websites. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to run unauthorized code on the user's computer. While the browser's security sandbox provides some protection, this flaw could lead to data theft or further system compromise if combined with other vulnerabilities.
Technical details
A type confusion vulnerability (CWE-843) exists in the WebAudio implementation of Google Chrome. The flaw occurs when the engine processes audio data using an incompatible type, leading to memory corruption. A remote, unauthenticated attacker can exploit this by hosting a malicious HTML page that, when visited by a victim, triggers the type confusion. Successful exploitation allows for arbitrary code execution within the renderer process sandbox. Google has addressed this issue in version 150.0.7871.182 for Windows and Mac, and 150.0.7871.181 for Linux.
Affected products
- Google Chrome prior to 150.0.7871.182
Timeline
- 2026-06-26: disclosed: Reported by XBOW and triaged by Chromium team
- 2026-07-21: patched: Fixed in Stable Channel Update 150.0.7871.182/181
- 2026-07-21: advisory