Introduction
A critical use after free in Google Chrome's WebRTC component on Linux allows remote code execution, and the victim only has to visit a malicious webpage. Chrome holds somewhere between 56% and 69% of the global browser market, depending on the source, so any remotely exploitable flaw in its codebase matters to defenders who manage Linux workstations and developer environments.
Technical Information
CVE-2026-9111 is classified under CWE-416 (Use After Free) and is in the WebRTC subsystem of Google Chrome. WebRTC provides real-time communication, including video and voice, directly in the browser. It is a complex native-code component that handles media streams, peer connections, and data channels, and it has historically been a rich attack surface.
Root Cause
A use-after-free condition occurs when an application keeps using a pointer after the memory it references has been freed, which leaves a dangling pointer. If the freed memory is later reallocated for a different object or buffer, any operation through the original pointer now acts on attacker-influenced data. By carefully manipulating the heap layout, an attacker can overwrite structures such as vtable pointers or function pointers, redirect execution flow, and gain arbitrary code execution within the renderer process.
The bug details are still restricted in the Chromium issue tracker (issue 504551032). Google normally withholds technical specifics until a majority of users have received the update, to keep threat actors from reverse engineering the patch before it is broadly deployed.
Attack Flow
- The attacker builds a malicious HTML page that exercises the vulnerable WebRTC code path on Linux.
- The victim, running a vulnerable version of Chrome on Linux (prior to 148.0.7778.179), navigates to the attacker-controlled page. The page could arrive through phishing, malvertising, or a compromised legitimate site.
- The crafted page triggers the use-after-free condition in the WebRTC component. The attack needs no user interaction beyond the initial page load.
- The attacker uses the dangling pointer to corrupt memory and gain arbitrary code execution within the Chrome process.
The CVSS score of 8.8 and Chromium's own Critical severity rating reflect the low barrier to exploitation (network accessible, no privileges required, no user interaction beyond visiting the page) and the high impact (arbitrary code execution).
Version Discrepancy
Official sources disagree on the fixed version for Linux. The CVE record explicitly states that Linux versions prior to 148.0.7778.179 are vulnerable. The Chrome Releases blog entry, however, lists version 148.0.7778.178 for Linux. The safest choice is to treat the 179 build as the minimum safe version on Linux.
| Platform | Chrome Releases Blog Version | CVE Record Safe Version | Resolution Action |
|---|---|---|---|
| Windows | 148.0.7778.178 or 179 | Not specified | Monitor rollout |
| macOS | 148.0.7778.178 or 179 | Not specified | Monitor rollout |
| Linux | 148.0.7778.178 | 148.0.7778.179 | Target 148.0.7778.179 |
Affected Systems and Versions
The vulnerability affects Google Chrome on Linux prior to version 148.0.7778.179. The CVE record and the NVD entry both state this version boundary explicitly. The Chrome Releases blog also lists Windows and macOS updates in the same stable channel release, but the CVE description names Linux as the affected platform.
Organizations should check the exact Chrome version deployed across their Linux fleet. The chrome://version page or the command-line flag google-chrome --version confirms the running build number.
Vendor Security History
Google runs a mature vulnerability management program for Chrome. Its Vulnerability Rewards Program rewards external researchers who find and responsibly disclose security flaws, and Google documents fixed security bugs publicly in the Stable Channel updates on the Chrome Releases blog. The May 20, 2026 update that addressed CVE-2026-9111 included 16 security fixes in total, in line with Google's usual practice of bundling several security fixes into each stable channel release.
