Quick Look: CVE-2026-9120, a Use After Free in Google Chrome's WebRTC Component Enabling Remote Code Execution

Introduction

A use-after-free vulnerability in Google Chrome's WebRTC component, scored at CVSS 8.8, lets a remote attacker execute arbitrary code by getting a user to visit a crafted HTML page. Chrome held 68.02 percent of the global browser market as of April 2026, so the potential exposure from CVE-2026-9120 covers billions of endpoints in both consumer and enterprise environments.

Technical Information

Root Cause: Use After Free in WebRTC

CVE-2026-9120 is classified under CWE-416 (Use After Free). This class of vulnerability occurs when software keeps referencing a memory region after that memory has been freed and possibly reallocated for a different purpose. In Chrome, the flaw is in the WebRTC component, which handles real-time audio and video communication and data channel management.

WebRTC is particularly prone to use-after-free conditions because its sessions involve complex, asynchronous object lifecycles. Multiple threads manage peer connections, media streams, and network transports at the same time. If a WebRTC object is freed while a dangling reference to it persists, a later dereference can reach memory that now holds something else entirely. An attacker who can influence what data occupies that reallocated region gets a strong primitive for arbitrary code execution.

Attack Flow

Exploiting CVE-2026-9120 asks very little of the attacker:

1. The attacker crafts a malicious HTML page that triggers specific WebRTC operations to provoke the use-after-free condition.
2. The victim visits the attacker-controlled page, or is redirected to it through phishing, malvertising, or a compromised legitimate site.
3. Chrome's WebRTC implementation processes the page content and frees a WebRTC object while a reference to it still exists.
4. The crafted page manipulates memory allocation to place controlled data into the freed memory region.
5. When Chrome dereferences the stale pointer, it operates on attacker-controlled data, which allows arbitrary code execution in the context of the Chrome renderer process.

The attack needs no authentication, no special privileges, and no extensive user interaction beyond visiting the page. The Chromium security team rated the flaw High severity.

Patch Information

Google fixed CVE-2026-9120 in a Stable channel update for Chrome desktop released on May 20, 2026. The patched versions are:

• Windows and macOS: 148.0.7778.178 or 148.0.7778.179
• Linux: 148.0.7778.178

The NVD description scopes the vulnerability to versions "prior to 148.0.7778.179," which places the fix boundary at that build. The Chocolatey package repository also had version 148.0.7778.179 available as of May 20, 2026.

Chrome updates automatically in the background, but the update only applies after the user closes and reopens the browser. Organizations managing fleets of endpoints should enforce browser restarts so the patch takes effect.

To check the update manually:

1. Open Chrome.
2. Click the three dots in the top right corner.
3. Click Help, then select About Chrome.
4. Chrome checks for updates and shows the current version number.

The Chromium bug tracker entry (Issue #504620824) is still restricted, so the source-level commit details and diff for this fix are not public yet. Google keeps security bug details locked until a significant percentage of users have updated, so attackers cannot reverse engineer the patch before the fix is widely deployed.

Affected Systems and Versions

All versions of Google Chrome prior to 148.0.7778.179 are affected. By platform:

• Google Chrome for Windows: all versions prior to 148.0.7778.179
• Google Chrome for macOS: all versions prior to 148.0.7778.179
• Google Chrome for Linux: all versions prior to 148.0.7778.178

At a 68.02 percent global market share, that is a large affected population. Other Chromium-based browsers that use the same WebRTC codebase may also be affected. Check each vendor's own advisory for confirmation.

Vendor Security History

Google invests heavily in Chrome security. It runs the Chrome Vulnerability Reward Program, which gives monetary awards and public credit to researchers who report flaws. Historically, Chrome shipped a new milestone every six weeks to deliver security and stability improvements.

Even so, Chrome's complex C++ codebase keeps producing memory safety vulnerabilities. Earlier in 2026, Google patched multiple actively exploited zero days:

• CVE-2026-5281: an actively exploited flaw in the WebGPU Dawn component
• CVE-2026-2441: an actively exploited vulnerability in the CSS component
• CVE-2026-4445 and CVE-2026-4446: both use-after-free vulnerabilities in WebRTC, fixed in earlier Chrome 146.x releases

Repeated use-after-free bugs in WebRTC show how hard memory safety is to manage in a component with highly concurrent, asynchronous object lifecycles.

References

• NVD: CVE-2026-9120
• CVE Record: CVE-2026-9120
• Chrome Releases: Stable Channel Update for Desktop (May 2026)
• Chromium Bug Tracker: Issue 504620824
• Chocolatey: Google Chrome Package
• CWE-416: Use After Free (MITRE)
• StatCounter: Browser Market Share Worldwide
• Google Chrome Update Instructions
• Chromium Blog: Speeding Up Release Cycle
• Chrome Vulnerability Reward Program FAQ
• Google Fixes Fourth Actively Exploited Chrome Zero Day of 2026