Executive brief
Google Chrome is a widely used web browser. A vulnerability in its media handling component could allow a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized actions or be used as part of a larger attack chain to compromise the system.
Technical details
A use-after-free (UAF) vulnerability exists in the Media component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the processing of media content, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution within the context of the Chromium sandbox. The vulnerability affects versions prior to 147.0.7727.138 and has been addressed in the latest stable channel updates for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-03-31: disclosed: Reported by Google internal researchers
- 2026-04-28: patched: Fixed in version 147.0.7727.138
- 2026-04-28: advisory