Overview
WebAudio handles a resource as one type and later reads it as another. That mismatch gives a page a memory corruption primitive inside the renderer.
A crafted HTML page triggers the confusion and runs code inside the sandbox. Chromium rates it High. Fixed in Chrome 150.0.7871.182, released 21 July 2026, alongside CVE-2026-16421 in the same component.
Affected products
- Google Chrome before 150.0.7871.182 (Windows, Mac) and 150.0.7871.181 (Linux)
Disclosure timeline
- 21 Jul 2026
- Chrome 150.0.7871.182 stable release with the fix; CVE-2026-16420 published