Skip to main content

Chrome CVE-2026-5278

| EUVDEUVD-2026-17789 HIGH
Use After Free (CWE-416)
2026-04-01 Chrome
Google Use After Free RCE Memory Corruption Denial Of Service Debian Red Hat Suse Chrome
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
9.6 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Apr 01, 2026 - 05:15 nvd
Patch available
EUVD ID Assigned
Apr 01, 2026 - 05:15 euvd
EUVD-2026-17789
Analysis Generated
Apr 01, 2026 - 05:15 vuln.today
CVE Published
Apr 01, 2026 - 04:41 nvd
HIGH 8.8

DescriptionCVE.org

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Android via use-after-free vulnerability in Web MIDI allows unauthenticated remote attackers to execute arbitrary code through a crafted HTML page. The vulnerability affects Chrome versions prior to 146.0.7680.178 and carries high severity per Chromium's security classification. A vendor-released patch is available.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) memory corruption flaw in the Web MIDI API implementation within Google Chrome's Android rendering engine. Web MIDI (Web Audio API MIDI support) enables JavaScript access to MIDI input/output devices via the browser. The use-after-free occurs when memory previously allocated to a MIDI-related object is freed but subsequently accessed without proper validation, allowing an attacker to manipulate freed memory and potentially redirect execution flow. This is a memory safety vulnerability endemic to C++-based browser engines when object lifecycle management fails. The defect is specific to Android, suggesting platform-specific MIDI handling code paths contain the flaw.

RemediationAI

Users must upgrade Google Chrome on Android to version 146.0.7680.178 or later, which contains the vendor-released patch. This update is available through the Google Play Store automatic update mechanism or manual installation via Settings > Apps > Chrome > Update. For enterprise deployments, administrators should enforce policy-driven updates via Chrome Enterprise management console. No configuration workarounds or version-specific mitigations are documented; patching is the sole remediation path. Verification of installed version can be confirmed via Chrome Settings > About Chrome, which displays the current version and initiates automatic update checks.

More in Chrome

View all
CVE-2015-5122 CRITICAL POC
9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
CVE-2016-5198 HIGH POC
8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH POC
8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
CVE-2016-1646 HIGH POC
8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2017-5030 HIGH POC
8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2015-5123 CRITICAL
9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

Debian

chromium
Release Status Fixed Version Urgency
bullseye (security), bullseye vulnerable 120.0.6099.224-1~deb11u1 -
bookworm vulnerable 143.0.7499.169-1~deb12u1 -
bookworm (security) vulnerable 146.0.7680.164-1~deb12u1 -
trixie vulnerable 145.0.7632.159-1~deb13u1 -
trixie (security) vulnerable 146.0.7680.164-1~deb13u1 -
forky vulnerable 146.0.7680.153-1 -
sid fixed 146.0.7680.177-1 -
bullseye fixed (unfixed) end-of-life
(unstable) fixed 146.0.7680.177-1 -

SUSE

Severity: High

Share

CVE-2026-5278 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy