Google CVE-2026-5280

The victim must visit or be directed to a crafted HTML page while using Google Chrome versions prior to 146.0.7680.178. No special configuration required—affects default Chrome installations. Remote attacker, requires user interaction (visiting the malicious page).

This vulnerability presents a significant real-world risk despite the absence of a CVSS score in available data. The attack vector is network-based and requires no user authentication-only that a victim visit a crafted webpage-making it broadly exploitable. Google's assignment of 'High' security severity, combined with the CWE-416 classification, indicates the defect is well-understood and likely not trivial to exploit but feasible for skilled attackers. The use-after-free nature suggests reliable exploitation may be possible with memory layout knowledge. The sandbox constraint provides some defense-in-depth, reducing immediate system compromise risk, but remote code execution within the sandbox is a critical finding. No EPSS probability or CISA KEV status is available, but the rapid patch release and high severity designation suggest Google prioritized this as a genuine threat. Organizations relying on Chrome for web browsing should treat this as a priority patch.

An attacker crafts a malicious HTML page containing specially formatted media or WebCodecs operations designed to trigger a use-after-free condition in Chrome's codec processing. When a victim visits the page in an unpatched Chrome browser, the vulnerability is triggered, allowing the attacker to execute arbitrary code within the Chrome sandbox. While sandboxed, this provides the attacker with code execution privileges that could be leveraged for further exploitation, credential theft, or persistence. No public proof-of-concept or active exploitation in the wild has been identified at the time of analysis, but the ease of distribution via web pages makes this a credible threat vector.