Executive brief
A security vulnerability exists in Google Chrome's WebRTC component, which handles real-time communication like video and audio calls. By tricking a user into visiting a specially crafted website, an attacker could potentially execute malicious code on the user's computer. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized data access or be used as part of a larger attack chain.
Technical details
A heap-based buffer overflow (CWE-122) exists in the WebRTC component of Google Chrome. The vulnerability is reachable via a specially crafted HTML page, allowing a remote, unauthenticated attacker to trigger memory corruption. Successful exploitation could lead to arbitrary code execution within the context of the browser's sandboxed renderer process. The issue is resolved in Chrome version 149.0.7827.155 and later.
Affected products
- Google Chrome prior to 149.0.7827.155
Timeline
- 2026-05-15: other: Reported to Google by internal/external researchers
- 2026-06-16: patched: Stable channel update released for Windows, Mac, and Linux
- 2026-06-17: advisory: NVD and Chrome release advisory published