CVE-2026-5860: Google Chrome WebRTC Use-After-Free Flaw

CVE-2026-5860 Overview

CVE-2026-5860 is a Use After Free vulnerability in the WebRTC component of Google Chrome versions prior to 147.0.7727.55. This memory corruption flaw allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Google has classified the Chromium security severity as High.

Critical Impact

Remote code execution within the browser sandbox through malicious web content targeting the WebRTC subsystem.

Affected Products

• Google Chrome prior to version 147.0.7727.55
• Chromium-based browsers using affected WebRTC component versions

Discovery Timeline

• 2026-04-08 - CVE-2026-5860 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-5860

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption issue that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of Google Chrome's WebRTC implementation, this flaw can be triggered through specially crafted HTML content that manipulates the WebRTC media handling or peer connection mechanisms.

Use After Free vulnerabilities in browser components are particularly dangerous because they can lead to arbitrary code execution. When exploited, an attacker can potentially corrupt memory structures, hijack control flow, and execute malicious code within the browser's sandboxed environment.

Root Cause

The root cause is improper memory management within Chrome's WebRTC implementation. When certain WebRTC objects are deallocated, dangling pointers remain accessible, allowing subsequent operations to reference freed memory. This condition creates an exploitable primitive that attackers can leverage to achieve code execution.

WebRTC's complexity in handling real-time media streams, peer connections, and data channels creates multiple opportunities for object lifecycle management errors. The asynchronous nature of these operations increases the likelihood of use-after-free conditions occurring during object destruction sequences.

Attack Vector

Exploitation requires the victim to visit a malicious webpage containing crafted HTML and JavaScript that triggers the vulnerable code path in the WebRTC subsystem. The attack is remotely exploitable and requires no authentication or special privileges beyond convincing a user to navigate to the attacker-controlled page.

The vulnerability can be triggered through various WebRTC APIs, potentially including RTCPeerConnection, media stream handling, or data channel operations. The attacker crafts specific sequences of WebRTC calls that cause premature object deallocation while maintaining references to the freed memory.

Technical details regarding specific exploitation methods can be found in the Chromium Issue Tracker Entry once the security restriction period ends.

Detection Methods for CVE-2026-5860

Indicators of Compromise

• Unusual browser crashes or memory corruption errors when visiting untrusted websites
• Unexpected WebRTC connection attempts or media stream initializations from web pages
• Browser process spawning suspicious child processes or network connections
• Anomalous memory allocation patterns in Chrome's renderer processes

Detection Strategies

• Monitor Chrome browser versions across endpoints and flag any instances running versions prior to 147.0.7727.55
• Deploy network monitoring to detect potential exploitation attempts through malicious web traffic targeting WebRTC
• Implement endpoint detection rules to identify suspicious JavaScript behavior related to WebRTC API abuse
• Utilize SentinelOne's Behavioral AI to detect memory corruption exploitation attempts in browser processes

Monitoring Recommendations

• Enable Chrome's built-in crash reporting to capture potential exploitation attempts
• Monitor for unusual resource consumption in browser renderer processes
• Track WebRTC-related events and connections for anomalous patterns
• Review browser extension activity that may interact with WebRTC functionality

How to Mitigate CVE-2026-5860

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.55 or later immediately across all endpoints
• Ensure automatic updates are enabled for Chrome browsers in your organization
• Consider blocking access to untrusted websites until patching is complete
• Monitor for any indicators of compromise related to browser exploitation

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 147.0.7727.55. The patch details are available in the Google Chrome Stable Update announcement. Organizations should prioritize deploying this update through their software management solutions.

The fix addresses the memory management issue in the WebRTC component by ensuring proper object lifecycle handling and preventing access to freed memory regions.

Workarounds

• Disable WebRTC functionality via Chrome flags (chrome://flags/#enable-webrtc) if not required for business operations
• Implement browser isolation solutions to contain potential exploitation attempts
• Use enterprise browser policies to restrict access to untrusted websites
• Deploy content filtering to block known malicious domains serving exploit code

# Chrome Enterprise Policy - Disable WebRTC (if feasible for your environment)
# Add to Chrome policies file or Group Policy
{
  "WebRtcAllowLegacyTLSProtocols": false,
  "WebRtcLocalIpsAllowedUrls": [],
  "WebRtcEventLogCollectionAllowed": false
}