Executive brief
A vulnerability in Google Chrome's audio processing component could allow a malicious website to access sensitive information from the browser's memory. This occurs when a user visits a specially crafted webpage on a Mac computer. An attacker could use this to potentially steal private data, though it does not allow them to modify files or take control of the system directly.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the WebAudio component of Google Chrome on macOS. The flaw is triggered when the browser processes a specially crafted HTML page, allowing a remote attacker to read data beyond the intended buffer in the process memory. This can lead to the disclosure of sensitive information from the browser process. The attack requires user interaction (visiting a malicious site) and has a high complexity (AC:H) according to CVSS metrics. The issue was addressed in Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-02-18: other: Reported to Chromium project
- 2026-04-07: patched: Stable channel update released
- 2026-04-08: disclosed: Initial NVD publication