Google Chrome: Use-after-free in MediaStream
Summary
A use-after-free flaw (CWE-416) in the MediaStream component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, for example via a link in email or an advertisement. Escaping the sandbox to take full control of the system would require a separate exploit, which the sources do not cover.
Affected
- Google Chrome prior to 154.0.8037.97 (desktop)
- Linux distributions ship their own Chromium builds with different version strings, so check the distribution's package version
Fixed in
- Google Chrome 154.0.8037.97 or later (Windows and Mac 154.0.8037.97/.98, Linux 154.0.8037.97), per the Chrome Releases blog
- Newer Chrome stable releases also contain later MediaStream fixes; install the current stable version
Workaround
No workaround is needed once a patched version is installed. Until then, avoid opening untrusted links in the browser.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed as known exploited (KEV) by a third-party aggregator
- No public proof of concept found; this is a negative search result only
Our recommendation
- Update Chrome to the current stable release across all desktops, within days rather than weeks
- Verify the installed version on every device, since phased rollouts can delay updates
- Enforce updates on managed devices via Chrome Enterprise policy
- Monitor for exploitation reports and remind users not to open untrusted links
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- OSV: DEBIAN-CVE-2026-103623 osv.dev
- Vulners NVD record CVE-2026-103623 vulners.com
- CISA ADP Vulnrichment mirror (HOL Guard) hol.org
- Strix CVE-2026-103623 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:46.
Original description (NVD)
Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.