CVE-2026-5883: Use after free in Media in Google Chrome prior to 147

Synopsis

A use-after-free vulnerability in the Media component of Google Chrome (versions prior to 147.0.7727.55) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to visit or interact with a malicious page. Successful exploitation gives the attacker arbitrary code execution within the browser sandbox, which can serve as a stepping stone to deeper compromise. A patched-image rebuild at version 147.0.7727.55 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable by the user browsing to an attacker-controlled or compromised web page.

• AuthenticationNot required

  No account, credential, or prior authentication is needed; any user who visits the crafted page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or a malicious ad/link the primary delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox, enabling full read access to in-browser data such as session tokens, saved credentials, and page content.
• With code execution in the renderer, the attacker can write or tamper with in-browser state and intercept or modify network requests made by the affected tab.
• A sandbox escape chained on top of this vulnerability would extend attacker control to the underlying host process, though that requires a second distinct exploit.
• The affected service (the Chrome renderer process) can be crashed at will, disrupting the user's browsing session.