CVE-2026-5890: Race in WebCodecs in Google Chrome prior to 147

Synopsis

A race condition in the WebCodecs component of Google Chrome prior to version 147.0.7727.55 allows a remote attacker to exploit timing-sensitive behavior in the browser's media processing pipeline. Exploitation requires the attacker to serve a crafted HTML page to a victim, who must visit it, and the attack succeeds over a network connection without any authentication. Successful exploitation gives the attacker read access to process memory contents, enabling disclosure of sensitive in-memory data. A patched-image rebuild at version 147.0.7727.55 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page to a browser that can be accessed remotely.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must visit the attacker-controlled page in a Chrome browser, making this a social-engineering vector where the user must be lured to the URL.

• Attack complexityDetail

  Attack complexity is high, meaning the exploit depends on winning a race condition and is not reliably reproducible on demand; timing and environmental factors affect success rate.

Blast Radius

• Reads contents of the Chrome renderer process memory, which may include session tokens, credentials, or other in-memory secrets.
• Reads in-memory data belonging to the current browsing session, including page content loaded from authenticated contexts.
• The scope of memory disclosure is bounded to the affected process, but the specific contents depend on what the renderer has processed at the time of exploitation.