Executive brief
Google Chrome is a widely used web browser for accessing the internet. A security flaw in its media handling component could allow an attacker to run unauthorized code on a user's computer if they visit a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized access to data or be used as part of a larger attack to compromise the entire system.
Technical details
A use-after-free (UAF) vulnerability exists in the media component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory for media objects, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious website, a remote attacker can exploit this condition to execute arbitrary code within the context of the Chromium sandbox. This vulnerability was addressed in version 147.0.7727.138 for Windows, Mac, and Linux. Exploitation requires user interaction (visiting a crafted page) but no special privileges.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-04-07: other: Reported to Chromium by researchers Jungwoo Lee and Wongi Lee
- 2026-04-28: advisory: Google published the security advisory and stable channel update
- 2026-04-28: patched: Fixed in version 147.0.7727.138