CVE-2026-5860: Google Chrome Use After Free Vulnerability

CVE-2026-5860 Overview

CVE-2026-5860 is a use-after-free vulnerability in the WebRTC component of Google Chrome versions prior to 147.0.7727.55. A remote attacker can exploit this flaw by serving a crafted HTML page, leading to arbitrary code execution inside the Chrome sandbox. The vulnerability affects Chrome on Windows, macOS, and Linux platforms. Google has classified the Chromium security severity as High and addressed the issue in the stable channel update for desktop.

Critical Impact

Remote attackers can execute arbitrary code within the Chrome renderer sandbox by enticing a user to visit a malicious web page using WebRTC features.

Affected Products

• Google Chrome versions prior to 147.0.7727.55
• Chrome on Microsoft Windows, Apple macOS, and Linux
• Chromium-based browsers incorporating the vulnerable WebRTC code

Discovery Timeline

• 2026-04-08 - CVE-2026-5860 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-5860

Vulnerability Analysis

The flaw is a use-after-free condition [CWE-416] within Chrome's WebRTC implementation. WebRTC (Web Real-Time Communication) enables peer-to-peer audio, video, and data exchange directly between browsers. The component manages complex object lifetimes across signaling, media, and network layers, which creates conditions where freed memory may be referenced after deallocation.

When exploited, the use-after-free corrupts heap memory and grants the attacker control over a freed object's vtable or function pointers. This typically yields renderer-process code execution. Chrome's site isolation and sandbox limit the immediate blast radius, but attackers commonly chain such flaws with a sandbox escape to achieve full system compromise.

Root Cause

The vulnerability stems from improper object lifetime management in WebRTC. Code paths reference an object after it has been freed, allowing an attacker to allocate controlled data into the freed slot. Subsequent dereferences operate on attacker-controlled memory, breaking memory safety guarantees.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome browser. The attacker hosts JavaScript that exercises specific WebRTC APIs to trigger the use-after-free. User interaction is limited to visiting the page, making drive-by compromise via malvertising or phishing links a realistic delivery method.

No public proof-of-concept exploit code is currently available. See the Chromium Issue Tracker entry for technical details once Google releases issue restrictions.

Detection Methods for CVE-2026-5860

Indicators of Compromise

• Chrome renderer process crashes or unexpected child process spawns following WebRTC sessions
• Outbound connections to unfamiliar STUN, TURN, or signaling servers initiated by chrome.exe
• Unusual browser-spawned processes such as command shells, PowerShell, or scripting engines
• Browser version strings reporting Chrome builds older than 147.0.7727.55

Detection Strategies

• Inventory installed Chrome versions across endpoints and flag any build below 147.0.7727.55
• Monitor for anomalous parent-child process relationships originating from the browser process
• Inspect web proxy logs for HTML pages invoking WebRTC APIs from low-reputation domains
• Correlate browser crash telemetry with subsequent suspicious process or network activity

Monitoring Recommendations

• Enable endpoint telemetry that captures process creation events with full command lines
• Track Chrome auto-update status and alert on devices stuck on outdated versions
• Review DNS and TLS logs for connections to attacker-controlled signaling infrastructure

How to Mitigate CVE-2026-5860

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later on all Windows, macOS, and Linux endpoints
• Restart browsers after patching to ensure the updated binaries are loaded into memory
• Verify enterprise update policies are not blocking the stable channel rollout
• Audit Chromium-based browsers (Edge, Brave, Opera) for upstream patch availability

Patch Information

Google released the fix in the Chrome stable channel update for desktop. Details are available in the Google Chrome stable channel update announcement. Administrators should confirm deployment via chrome://settings/help or centralized management tooling.

Workarounds

• Disable WebRTC via enterprise policy where business workflows do not require it
• Restrict browser access to untrusted sites using DNS filtering or secure web gateways
• Apply Chrome enterprise policies to enforce auto-updates and prevent version pinning to vulnerable builds

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Windows registry policy to enforce Chrome auto-updates
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f