Executive brief
A security vulnerability in Google Chrome's media handling component could allow a remote attacker to execute unauthorized code on a user's computer. To exploit this, an attacker would need to trick a user into visiting a malicious website and performing specific interactions or gestures within the browser interface. This could lead to a total compromise of the browser session and the underlying system data.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the Media component of Google Chrome prior to version 147.0.7727.101. The flaw is triggered when a user is convinced to engage in specific UI gestures while viewing a specially crafted HTML page. This memory corruption issue can be leveraged by a remote attacker to achieve arbitrary code execution within the context of the browser process. The attack requires user interaction and has a high complexity due to the specific UI gestures required, but it results in high impacts to confidentiality, integrity, and availability. Google has addressed this in the stable channel update to version 147.0.7727.101.
Affected products
- Google Chrome prior to 147.0.7727.101
Timeline
- 2026-03-29: disclosed: Reported by Google internal researchers
- 2026-04-15: patched: Fixed in Chrome version 147.0.7727.101/102
- 2026-04-15: advisory