Executive brief
A vulnerability in Google Chrome's WebRTC component could allow a malicious website to access sensitive information from the browser's memory. WebRTC is the technology used for real-time communication like video calls and voice chat within the browser. By tricking a user into visiting a specially crafted webpage, an attacker could potentially read data they are not authorized to see, which could lead to the exposure of private user information.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the WebRTC component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to memory access outside of the intended buffer. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, potentially allowing the attacker to leak sensitive information from the browser's process memory. The vulnerability was addressed in Chrome version 149.0.7827.53 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published in NVD.