Security Advisory

CVE-2026-8524: Google Chrome Out-of-Bounds Write in WebAudio

Out-of-bounds write in WebAudio allowed a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page.

Overview

WebAudio is the Chrome component that processes audio graphs built from JavaScript. A flaw in its buffer handling lets a page write past the end of an allocation.

A crafted HTML page triggers the write and runs code inside the renderer sandbox. Chromium rates it High; NVD scores it 8.8. Google shipped the fix in Chrome 148.0.7778.168 on 14 May 2026.

Affected products

  • Google Chrome before 148.0.7778.168

Disclosure timeline

14 May 2026
Chrome 148.0.7778.168 stable release with the fix; CVE-2026-8524 published