CVE-2026-5278: Google Chrome Use After Free Vulnerability

CVE-2026-5278 Overview

CVE-2026-5278 is a use-after-free vulnerability [CWE-416] in the Web MIDI component of Google Chrome on Android. The flaw affects Chrome versions prior to 146.0.7680.178. A remote attacker can trigger the vulnerability by enticing a user to visit a crafted HTML page, leading to arbitrary code execution within the browser process.

Google assigned Chromium security severity High to this issue. The vulnerability requires user interaction, but does not require authentication or elevated privileges. While the Android build is explicitly named in the advisory, the underlying Web MIDI code is shared across Chromium-based browsers on multiple desktop platforms.

Critical Impact
Remote attackers can execute arbitrary code in the renderer process by luring users to a malicious web page that abuses Web MIDI APIs.

Affected Products

Google Chrome on Android prior to 146.0.7680.178
Chromium-based builds on Microsoft Windows, Apple macOS, and Linux that incorporate the vulnerable Web MIDI implementation
Downstream browsers and embedded WebViews that ship the affected Chromium release

Discovery Timeline

2026-04-01 - CVE-2026-5278 published to the National Vulnerability Database
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5278

Vulnerability Analysis

The vulnerability resides in Chrome's Web MIDI implementation, which exposes Musical Instrument Digital Interface (MIDI) device access to web content through JavaScript APIs. A use-after-free condition occurs when the browser dereferences a freed object associated with MIDI session or port state. The freed memory can be reclaimed and shaped by attacker-controlled data before the dangling reference is used.

When exploited, the attacker can corrupt internal browser state and ultimately hijack control flow within the renderer or browser process handling MIDI. The Chromium project tracks the underlying defect in Chromium Issue Report #490254128.

The issue is reachable from any origin that successfully obtains MIDI access from the user. Combined with a sandbox escape, this class of bug has historically enabled full device compromise on Chromium-based browsers.

Root Cause

The root cause is improper object lifetime management within the Web MIDI subsystem. An object reference is retained and later used after the underlying memory has been released, producing classic use-after-free behavior consistent with [CWE-416].

Attack Vector

Exploitation is performed over the network. The attacker hosts a crafted HTML page that invokes Web MIDI APIs in a specific sequence to free a tracked object and then reuse the dangling reference. The victim must visit the page and, depending on the attack path, approve MIDI access. No authentication or prior foothold is required.

No verified public exploit code is currently available for CVE-2026-5278. The vulnerability mechanism is described in prose; refer to the Chromium Issue Report #490254128 for upstream technical details once access restrictions are lifted.

Detection Methods for CVE-2026-5278

Indicators of Compromise

Chrome browser processes on Android crashing or spawning unexpected child processes after visiting an untrusted page that invoked Web MIDI APIs.
Outbound connections from browser processes to attacker-controlled infrastructure shortly after rendering a page that requested MIDI device access.
Endpoint telemetry showing renderer process anomalies, such as unusual memory allocations or attempted writes to executable regions.

Detection Strategies

Inventory installed Chrome versions across managed Android, Windows, macOS, and Linux endpoints and flag any build older than 146.0.7680.178.
Monitor proxy and DNS logs for browsing sessions that load pages invoking the requestMIDIAccess() API from unfamiliar domains.
Correlate browser crash reports with subsequent process or network anomalies to surface possible post-exploitation activity.

Monitoring Recommendations

Forward browser crash dumps and Chrome update telemetry into a centralized logging platform for version compliance reporting.
Alert on child processes spawned by chrome.exe, Google Chrome Helper, or the Android Chrome package that are not part of the standard browser hierarchy.
Track failed or repeated MIDI permission prompts across user populations as a potential reconnaissance indicator.

How to Mitigate CVE-2026-5278

Immediate Actions Required

Update Google Chrome on Android to version 146.0.7680.178 or later through Google Play.
Update Chrome on Windows, macOS, and Linux to the latest Stable channel build referenced in the Google Chrome Update Announcement.
Restart all Chrome instances after update to ensure the patched binary is loaded into memory.

Patch Information

Google released the fix in the Stable channel update covered by the Google Chrome Update Announcement. Administrators should enforce Chrome auto-update policies via enterprise management tooling and verify the deployed version is at or above 146.0.7680.178.

Workarounds

Disable Web MIDI through enterprise policy where the feature is not required, for example by setting DefaultMidiSysexSetting to block via Chrome Enterprise policy.
Restrict browsing to trusted sites using URL allowlists until patched builds are fully deployed across the fleet.
Train users to deny MIDI permission prompts from unfamiliar websites.

bash

# Chrome Enterprise policy example to block Web MIDI sysex by default
# Windows registry path:
# HKLM\Software\Policies\Google\Chrome\DefaultMidiSysexSetting = 2

# macOS configuration profile key:
# DefaultMidiSysexSetting = 2  # 2 = Block