Executive brief
A vulnerability in Google Chrome's WebCodecs component could allow a malicious website to access sensitive information from the browser's memory. This occurs when a user visits a specially crafted webpage, potentially leading to the exposure of private data from other open tabs or browser processes. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
An uninitialized use vulnerability (CWE-457) exists in the WebCodecs component of Google Chrome prior to version 147.0.7727.55. The flaw is triggered when the browser processes a specially crafted HTML page, leading to the use of uninitialized memory during media encoding or decoding operations. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, allowing the attacker to read potentially sensitive information from the browser's process memory. This is a side-channel or information disclosure risk that does not directly allow for code execution but can be used to bypass security boundaries. The issue is resolved in Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-02-22: other: Vulnerability reported to Chromium by the Octane Security Team
- 2026-04-07: patched: Chrome 147.0.7727.55 released to stable channel
- 2026-04-08: advisory: CVE-2026-5888 published