Executive brief
A security vulnerability exists in Google Chrome's WebCodecs component, which handles audio and video processing. By tricking a user into visiting a specially crafted website, an attacker could exploit a timing issue to access sensitive information stored in the browser's memory. This could lead to the exposure of private data from other open tabs or browser processes.
Technical details
A race condition (CWE-362) exists in the WebCodecs implementation of Google Chrome. The vulnerability is triggered when the browser processes a maliciously crafted HTML page, leading to improper synchronization during concurrent execution. A remote, unauthenticated attacker can exploit this flaw to perform a side-channel attack or direct memory disclosure, allowing them to read sensitive information from the browser's process memory. The attack requires user interaction (visiting a malicious site) and has a high attack complexity due to the nature of race conditions. The issue is resolved in Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-02-24: disclosed: Reported by Casper Woudenberg
- 2026-04-07: patched: Fixed in Chrome 147.0.7727.55 stable channel update
- 2026-04-08: advisory: NVD published date