Description
Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-01
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free bug in the Web MIDI implementation of Chrome on Android allows a malicious HTML page to trigger heap corruption, giving an attacker the ability to execute arbitrary code with the privileges of the browser process. This vulnerability is catalogued as CWE‑416 and CWE‑825 and can compromise the integrity and confidentiality of the device.

Affected Systems

The flaw affects Google Chrome browsers running on Android devices with versions older than 146.0.7680.178. The vendor’s March 2026 release notes list this issue in the stable channel, meaning any Android device that has not yet upgraded Chrome to 146.0.7680.178 or newer remains vulnerable.

Risk and Exploitability

The CVSS base score of 8.8 indicates a high severity condition, while the EPSS score of less than 1% reflects a low current exploitation probability. The attack requires a victim to load a crafted web page, making it a web‑based exploit path. No publicly known exploits are documented, and the vulnerability is not yet in the CISA KEV catalog, but it still poses a significant remote code execution risk if left unpatched.

Generated by OpenCVE AI on April 2, 2026 at 04:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 146.0.7680.178 or newer on all Android devices.
  • Verify the updated installation by checking the browser version in the settings menu.
  • If an immediate upgrade is not possible, consider disabling the Web MIDI API through enterprise policy or content security policy headers.
  • Continuously monitor Chrome release notes for additional updates and apply subsequent patches promptly.

Generated by OpenCVE AI on April 2, 2026 at 04:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6192-1 chromium security update
History

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Web MIDI
First Time appeared Apple
Apple macos
Google
Google chrome
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Weaknesses CWE-825
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Google
Google chrome
Linux
Linux linux Kernel
Microsoft
Microsoft windows
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

threat_severity

Important

Wed, 01 Apr 2026 05:00:00 +0000

Type Values Removed Values Added
Description Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-02T03:55:45.469Z

Reserved: 2026-03-31T20:07:12.284Z

Link: CVE-2026-5278

cve-icon Vulnrichment

Updated: 2026-04-01T13:26:06.167Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-01T05:16:01.070

Modified: 2026-04-01T17:09:45.597

Link: CVE-2026-5278

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-31T00:00:00Z

Links: CVE-2026-5278 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-02T20:18:23Z

Weaknesses