Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its WebRTC component, which handles real-time communication like video calls, could allow a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized access to data or further system compromise.
Technical details
A use-after-free (UAF) vulnerability exists in the WebRTC component of Google Chrome. The flaw is triggered when the browser improperly manages memory during the processing of real-time communication data. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious HTML page. Successful exploitation allows for arbitrary code execution within the context of the Chromium sandbox. The issue is resolved in Google Chrome version 147.0.7727.138 and later.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-04-09: disclosed: Reported by Mozilla
- 2026-04-28: patched: Fixed in version 147.0.7727.138
- 2026-04-28: advisory