Executive brief
Google Chrome's WebRTC component (used for real-time audio/video communication in web applications) contains a use-after-free vulnerability that allows attackers to execute arbitrary code within the browser's sandbox. An attacker can exploit this by tricking a user into visiting a malicious webpage, potentially leading to data theft, account compromise, or malware installation.
Technical details
A use-after-free vulnerability exists in the WebRTC implementation of Google Chrome prior to version 152.0.7977.75. The vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox by hosting a crafted HTML page that triggers the flaw through WebRTC operations. The attack requires no authentication and only user interaction (visiting a malicious page). The vulnerability has been patched in Chrome 152.0.7977.75 and later releases. The Chromium project assessed this as medium severity, though external sources reported it as high severity with a CVSS score of 8.8.
Affected products
- Google Chrome prior to 152.0.7977.75
Timeline
- 2026-09-02: disclosed: Public disclosure on 2026-09-02
- 2026-09-02: patched: Fixed in Chrome 152.0.7977.75