Executive brief
A vulnerability in Google Chrome's WebRTC component could allow an attacker with control over a user's network traffic to access data from other websites. WebRTC is the technology used for real-time communication like video calls and voice chat in the browser. If exploited, this could lead to the unauthorized disclosure of sensitive information that should normally be protected by the browser's security boundaries.
Technical details
A vulnerability classified as 'Inappropriate Implementation' exists in the WebRTC component of Google Chrome. The flaw stems from improper input validation (CWE-20) during the handling of network traffic. An attacker positioned in a privileged network location (such as a malicious Wi-Fi hotspot or a compromised router) can inject or manipulate network traffic to bypass cross-origin resource sharing (CORS) protections. This allows the attacker to leak data from origins other than the one the user is currently interacting with. The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD