Executive brief
Google Chrome's GetUserMedia component incorrectly validates permission checks, allowing a remote attacker to obtain sensitive information through a crafted webpage. This could expose access to device camera, microphone, or screen-sharing data without proper user authorization, potentially compromising privacy and sensitive business communications.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's GetUserMedia API (the Web Standard for accessing camera, microphone, and screen-capture devices). An attacker can craft a malicious HTML page that exploits improper permission validation to obtain media device access without proper user consent or warning. The attack is delivered remotely via a web page that a user must visit, making it network-accessible. An attacker can gain unauthorized access to media streams (camera/microphone/screen), potentially capturing sensitive conversations, visual information, or screen content. The vulnerability was patched in Chrome 152.0.7977.65 released on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: Published in Chrome Security Advisory
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65