Racing MIDI messages in Chrome

Summary: Chrome Security's Oliver Chang documented two use-after-free race conditions in Chrome's MIDI implementation, found during a Chrome IPC bug bash with Project Zero, that could be triggered directly from the web without compromising the sandboxed renderer. The first bug, in the ALSA implementation for Linux and Chrome OS, let a freed MidiHost object be called through an unretained pointer, and was fixed and shipped in Chrome 47.0.2526.106; the second, which likely also affected Windows, shipped in the first stable release of Chrome 48.
What you should know: A web page could reach a use-after-free in the privileged browser process using only the default dummy MIDI port, with no special permissions, and Chang's proof of concept overwrote the vtable pointer to redirect execution - roughly one successful attempt in five without SysEx access.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026