Executive brief
Google Chrome is a widely used web browser. A vulnerability in its WebRTC component, which handles real-time communication like video and audio calls, could allow an attacker to compromise a user's computer. By tricking a user into visiting a specially crafted website, an attacker could potentially execute unauthorized code, leading to data theft or full system takeover.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in the WebRTC component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to heap corruption. A remote, unauthenticated attacker can exploit this by inducing a user to visit a malicious website (User Interaction required). Successful exploitation could allow for arbitrary code execution within the context of the browser's process. The issue was addressed in Chrome version 147.0.7727.138 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-03-19: disclosed: Reported by external researcher
- 2026-04-28: patched: Fixed in version 147.0.7727.138
- 2026-04-28: advisory