Description
Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-01
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw in Chrome’s WebCodecs implementation allows a malicious website to trigger arbitrary code execution inside the browser sandbox. The vulnerability is identified as a use‑after‑free (CWE‑416) and is described as enabling a remote attacker to run attacker‑controlled code within the sandboxed process.

Affected Systems

The flaw is present in Google Chrome versions prior to 146.0.7680.178 on all desktop platforms, including Windows, macOS, and Linux, affecting users who have not applied the latest update.

Risk and Exploitability

The CVSS score of 8.8 reflects the serious impact of an exploitation that would result in arbitrary code execution in the sandbox. The EPSS score of less than 1% indicates an overall low probability of exploitation, and the vulnerability is not listed in CISA KEV. Attackers would likely deliver a crafted HTML page containing malicious WebCodecs usage to trigger the use‑after‑free and execute code within the browser process.

Generated by OpenCVE AI on April 18, 2026 at 17:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 146.0.7680.178 or later.
  • Ensure Chrome’s automatic update feature is enabled so future security fixes are installed promptly.
  • Monitor Chrome release notes for additional mitigations or patches related to WebCodecs.

Generated by OpenCVE AI on April 18, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6192-1 chromium security update
History

Thu, 02 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in WebCodecs
First Time appeared Apple
Apple macos
Google
Google chrome
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Weaknesses CWE-825
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Google
Google chrome
Linux
Linux linux Kernel
Microsoft
Microsoft windows
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

threat_severity

Important

Wed, 01 Apr 2026 05:00:00 +0000

Type Values Removed Values Added
Description Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-02T03:55:44.222Z

Reserved: 2026-03-31T20:07:12.932Z

Link: CVE-2026-5280

cve-icon Vulnrichment

Updated: 2026-04-01T13:24:17.216Z

cve-icon NVD

Status : Modified

Published: 2026-04-01T05:16:01.310

Modified: 2026-04-02T00:16:24.620

Link: CVE-2026-5280

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-31T00:00:00Z

Links: CVE-2026-5280 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T17:30:05Z

Weaknesses