Executive brief
Google Chrome is a widely used web browser. A security vulnerability was found in its SurfaceCapture component, which handles screen and video capture functionality. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially leading to a complete takeover of the browser or a system crash.
Technical details
A use-after-free (UAF) vulnerability exists in the SurfaceCapture component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the capture of screen or video surfaces. By enticing a user to visit a malicious HTML page, a remote attacker can exploit this memory corruption to achieve heap corruption. This can lead to arbitrary code execution within the context of the browser process or a browser crash (denial of service). The vulnerability is fixed in version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for Desktop
- 2026-05-28: disclosed: CVE published to NVD dataset