Executive brief
A security vulnerability exists in Google Chrome's WebRTC component, which handles real-time communication like video and audio calls. By tricking a user into visiting a specially crafted website, an attacker could potentially take control of the user's computer or execute unauthorized commands. This could lead to the theft of sensitive data or a complete compromise of the affected system.
Technical details
A use-after-free vulnerability (CWE-416) exists in the WebRTC component of Google Chrome. The flaw is triggered when the browser attempts to access memory that has already been freed, typically during the processing of real-time communication streams. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious HTML page. Successful exploitation allows for arbitrary code execution within the context of the browser process. The issue is resolved in Chrome version 148.0.7778.179 for Mac and Windows, and 148.0.7778.178 for Linux.
Affected products
- Google Chrome prior to 148.0.7778.179
Timeline
- 2026-04-20: disclosed: Reported by Google internal researchers
- 2026-05-19: patched: Stable channel update released
- 2026-05-20: advisory: NVD publication date