Executive brief
A security vulnerability exists in Google Chrome's media processing components. By tricking a user into visiting a specially crafted website, a remote attacker could execute unauthorized code on the user's computer. While this code execution is restricted by the browser's security sandbox, it still poses a significant risk to user data and system integrity.
Technical details
A use-after-free (UAF) vulnerability exists in the Codecs component of Google Chrome. The flaw is triggered when the browser improperly manages memory during the processing of media codecs, allowing an attacker to reference memory after it has been freed. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious HTML page. Successful exploitation allows for arbitrary code execution within the Chromium renderer sandbox. The issue is resolved in Google Chrome version 147.0.7727.138 and later.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-04-06: disclosed: Reported to Chromium by Google researchers
- 2026-04-28: patched: Fixed in Stable Channel Update 147.0.7727.138
- 2026-04-28: advisory