Executive brief
Google Chrome is a widely used web browser. A vulnerability in its WebRTC component, which handles real-time communication like video and audio calls, could allow an attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to data theft or further system compromise.
Technical details
A use-after-free (UAF) vulnerability exists in the WebRTC component of Google Chrome prior to version 147.0.7727.55. The flaw is triggered when the browser incorrectly manages memory during the processing of WebRTC content, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution within the confines of the Chromium sandbox. This vulnerability is tracked as CVE-2026-5860 and has been addressed in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-02-22: other: Reported to Chrome by researcher c6eed09fc8b174b0f3eebedcceb1e792
- 2026-04-07: patched: Fixed in Chrome version 147.0.7727.55
- 2026-04-08: disclosed: Public disclosure of the vulnerability