CVE-2026-5890: 
vulnerability analysis and mitigation

CVE-2026-5890 is a race condition vulnerability in the WebCodecs component of Google Chrome that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. It was reported by Casper Woudenberg on February 24, 2026, and publicly disclosed on April 7–8, 2026, as part of the Chrome 147 stable channel release. All versions of Google Chrome prior to 147.0.7727.55 are affected; Microsoft Edge (Chromium-based) is also listed as an affected product. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Chrome Advisory, GitHub Advisory).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The flaw exists in Chrome's WebCodecs API, where a timing window allows a concurrently executing code sequence to access or modify a shared resource before exclusive access is properly enforced. An attacker exploits this by serving a crafted HTML page that triggers the race condition in WebCodecs processing, causing the browser to inadvertently expose contents of process memory. Exploitation requires user interaction (visiting a malicious page) and has high attack complexity due to the timing-dependent nature of race conditions (Chrome Advisory, GitHub Advisory).

Successful exploitation allows a remote attacker to read potentially sensitive data from the Chrome renderer process memory, which could include authentication tokens, session cookies, user credentials, or other confidential in-memory data. The impact is limited to confidentiality — there is no integrity or availability impact. The vulnerability does not enable code execution or privilege escalation on its own, but leaked memory contents could facilitate further attacks (GitHub Advisory, Chrome Advisory).

1. Reconnaissance: Identify targets running Google Chrome versions prior to 147.0.7727.55 on Windows, Mac, or Linux.
2. Craft malicious HTML page: Develop an HTML page that invokes the WebCodecs API in a manner that triggers concurrent access to a shared resource, exploiting the race condition timing window.
3. Deliver the page: Host the crafted HTML page on an attacker-controlled server and lure the target user to visit it via phishing, malvertising, or a compromised website.
4. Trigger the race condition: When the victim loads the page, the JavaScript/WebCodecs operations race to access shared memory, and the timing window allows the attacker's code to read process memory contents.
5. Exfiltrate data: Leaked memory data (potentially containing tokens, credentials, or other sensitive values) is transmitted back to the attacker's server via network requests embedded in the page (Chrome Advisory, GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the browser to unexpected external domains immediately after visiting an unfamiliar page, potentially carrying encoded data in query parameters or POST bodies.
• Logs: Browser crash reports or renderer process anomalies logged around WebCodecs API usage; unusual JavaScript errors related to codec operations in browser developer console logs.
• Process: Unexpected network activity originating from the Chrome renderer process (chrome.exe / chrome subprocess) to external IPs not associated with normal browsing activity.

Google has released Chrome 147.0.7727.55 (Linux) and 147.0.7727.55/56 (Windows/Mac) which contain the fix for CVE-2026-5890. Users should update Chrome immediately via the browser's built-in update mechanism (Settings → Help → About Google Chrome). Organizations should enforce automatic browser updates via policy (e.g., Google Admin Console or enterprise MDM). As a temporary workaround where patching is not immediately possible, restricting access to untrusted or unknown websites reduces exposure. Microsoft Edge (Chromium-based) users should also apply the corresponding Edge update (Chrome Advisory, Microsoft MSRC).

The Chrome 147 release was covered by security news outlets including GBHackers, which highlighted the batch of 60+ vulnerabilities patched in the update, including two critical WebML flaws alongside this medium-severity WebCodecs race condition. The broader security community noted the high volume of fixes in this release. No specific researcher commentary or significant social media discussion focused exclusively on CVE-2026-5890 has been identified, consistent with its medium severity rating and lack of active exploitation.