Description
Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A type confusion flaw in the WebAudio implementation of Google Chrome permits a remote attacker, through a specially crafted HTML page, to execute arbitrary code within the browser’s sandbox. The vulnerability stems from improper type handling in audio processing, classified as CWE‑843, and can be exploited without requiring user interaction beyond visiting the malicious page.

Affected Systems

Google Chrome versions prior to 150.0.7871.182 are affected; all installations that run the vulnerable version on any supported platform are at risk.

Risk and Exploitability

The CVSS score is 8.8, indicating a high severity. The EPSS score is below 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to load a malicious page; it enables an attacker to execute code confined to the browser’s sandbox.

Generated by OpenCVE AI on August 4, 2026 at 00:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 150.0.7871.182 or later and enable automatic updates to receive future patches promptly
  • If immediate updating is not possible, consider disabling the WebAudio API for untrusted sites using CSP or site‑specific policy settings to prevent exploitation of the audio subsystem
  • Enforce strict enterprise browser policies that block audio playback from untrusted origins to reduce reliance on WebAudio processing

Generated by OpenCVE AI on August 4, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4701-1 chromium security update
Debian DSA Debian DSA DSA-6396-1 chromium security update
History

Sun, 02 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Title Type Confusion in Google Chrome WebAudio Leading to Remote Code Execution

Sat, 01 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Type Confusion in WebAudio Enables Remote Code Execution in Chrome

Sun, 26 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title Type Confusion in WebAudio Enables Remote Code Execution in Chrome

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 21 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-843
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-24T12:47:35.962Z

Reserved: 2026-07-20T22:23:06.498Z

Link: CVE-2026-16420

cve-icon Vulnrichment

Updated: 2026-07-24T12:47:31.603Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:30:18Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')