Executive brief
A vulnerability in Google Chrome's audio processing component could allow an attacker to execute malicious code on a user's computer. This occurs when a user visits a specially crafted website designed to trigger a memory error. While the attack is limited by Chrome's security sandbox, it could still lead to unauthorized actions or serve as a stepping stone for further system compromise.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the WebAudio component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page containing malicious audio content. A remote, unauthenticated attacker can exploit this to achieve arbitrary code execution within the context of the browser's sandboxed renderer process. The vulnerability was reported by external researchers and has been addressed in Chrome version 148.0.7778.168 for Mac and Windows, and 148.0.7778.167 for Linux.
Affected products
- Google Chrome Prior to 148.0.7778.168
Timeline
- 2026-04-06: other: Vulnerability reported to Chromium project
- 2026-05-12: patched: Stable channel update released
- 2026-05-14: disclosed: CVE published to NVD