## Summary
A use-after-free vulnerability in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is tracked as CVE-2026-5860 (Chromium security severity: High).
## Technical Details
- Vulnerability type: Use after free (CWE-CWE-416) in Chrome’s WebRTC component.
- Attack surface: Web content delivered to the browser (crafted HTML page).
- Exploitability: The NVD description indicates the attacker can trigger the flaw remotely and achieve arbitrary code execution inside a sandbox.
- Affected scope: Google Chrome versions earlier than 147.0.7727.55.
## Affected
- google chrome < 147.0.7727.55
## Impact
- Arbitrary code execution in the browser sandbox.
- Potential consequences indicated by the CVSS vector: confidentiality, integrity, and availability impact are all high (C:H/I:H/A:H).
## Mitigation
1. Update Google Chrome to 147.0.7727.55 or later (per the Chrome Stable channel update guidance).
2. Ensure users are protected from opening untrusted or newly crafted HTML content until patched.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416