CVE-2026-5292: Google Chrome Out of Bounds Vulnerability

CVE-2026-5292 Overview

CVE-2026-5292 is an out-of-bounds read vulnerability in the WebCodecs component of Google Chrome prior to version 146.0.7680.178. This memory safety issue allows a remote attacker to perform an out-of-bounds memory read by convincing a user to visit a specially crafted HTML page. The vulnerability affects Chrome across all major desktop operating systems including Windows, macOS, and Linux.

Critical Impact

Remote attackers can exploit this vulnerability to read sensitive memory contents, potentially leading to information disclosure or facilitating further attacks through memory leak primitives. User interaction (visiting a malicious page) is required for exploitation.

Affected Products

• Google Chrome versions prior to 146.0.7680.178
• Google Chrome on Microsoft Windows
• Google Chrome on Apple macOS
• Google Chrome on Linux

Discovery Timeline

• 2026-04-01 - CVE-2026-5292 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5292

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory corruption flaw where the application reads data past the end or before the beginning of an intended buffer. In the context of Chrome's WebCodecs API, this occurs when processing maliciously crafted media content that triggers improper bounds checking during codec operations.

WebCodecs is a relatively new web API that provides low-level access to media encoders and decoders, making it a sensitive attack surface. When the browser processes a crafted HTML page containing malicious WebCodecs operations, it can be forced to read memory beyond allocated buffer boundaries. This out-of-bounds read can expose sensitive information from the browser's memory space, including data from other browser contexts or internal runtime structures.

The vulnerability requires user interaction—specifically, navigating to an attacker-controlled webpage. Once triggered, the out-of-bounds read could be leveraged to bypass security mitigations like ASLR (Address Space Layout Randomization) by leaking memory addresses, or to extract sensitive data directly from memory.

Root Cause

The root cause is improper bounds validation in the WebCodecs implementation when handling media data. The code fails to properly verify that read operations stay within the allocated buffer boundaries, allowing attackers to craft input that causes reads beyond the intended memory region. This type of vulnerability commonly arises from incorrect length calculations, missing boundary checks, or integer-related issues in buffer size computations.

Attack Vector

The attack is network-based and requires user interaction. An attacker would craft a malicious HTML page containing JavaScript that interacts with the WebCodecs API in a way that triggers the out-of-bounds read. The attacker must then convince a victim to visit this page through social engineering, malvertising, or by compromising a legitimate website.

The exploitation flow involves:

1. Victim visits an attacker-controlled or compromised webpage
2. Malicious JavaScript on the page makes WebCodecs API calls with crafted parameters
3. Chrome's WebCodecs implementation reads memory beyond buffer boundaries
4. Attacker-controlled code on the page can potentially observe or exfiltrate the leaked memory data

Due to the nature of this vulnerability, no verified proof-of-concept code is publicly available. Refer to the Chromium Issue Tracker Entry for additional technical details when available.

Detection Methods for CVE-2026-5292

Indicators of Compromise

• Unusual WebCodecs API usage patterns in browser logs or telemetry
• Browser crashes or abnormal behavior when visiting specific websites
• Memory access violations or segmentation faults in Chrome crash reports referencing WebCodecs components
• Suspicious JavaScript attempting to instantiate VideoDecoder or AudioDecoder objects with malformed configurations

Detection Strategies

• Monitor endpoint telemetry for Chrome crash reports with signatures related to WebCodecs or media codec components
• Implement web proxy logging to identify access to known malicious domains serving WebCodecs exploits
• Deploy browser security policies that restrict or audit WebCodecs API usage where not required for business operations
• Use SentinelOne's behavioral AI to detect anomalous memory access patterns indicative of out-of-bounds read exploitation

Monitoring Recommendations

• Enable Chrome's built-in Safe Browsing protection to block access to known malicious sites
• Monitor for Chrome versions below 146.0.7680.178 in your asset inventory to identify vulnerable endpoints
• Review browser extension logs and content security policy violations that may indicate attempted exploitation
• Configure centralized logging for browser crash reports to identify potential exploitation attempts across your environment

How to Mitigate CVE-2026-5292

Immediate Actions Required

• Update Google Chrome to version 146.0.7680.178 or later immediately across all managed endpoints
• Enable automatic Chrome updates if not already configured to ensure timely delivery of security patches
• Review and validate that Chrome auto-update policies are functioning correctly in your enterprise environment
• Consider temporarily restricting access to untrusted websites until patching is complete

Patch Information

Google has addressed this vulnerability in Chrome version 146.0.7680.178. The fix was released as part of the stable channel update. Organizations should prioritize deployment of this update across all endpoints running Google Chrome.

For official patch details and release notes, refer to the Google Chrome Update Announcement.

Workarounds

• If immediate patching is not possible, consider using an alternative browser for accessing untrusted content until Chrome can be updated
• Implement network-level filtering to block access to known malicious domains that may be hosting exploit code
• Deploy content security policies that restrict the use of WebCodecs API on organizational web properties
• Use browser isolation technologies to contain potential exploitation attempts from affecting the host system

# Verify Chrome version on endpoints
# Linux/macOS
google-chrome --version

# Windows PowerShell - Check installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion

# Force Chrome update via command line (Linux)
sudo apt update && sudo apt install --only-upgrade google-chrome-stable