Executive brief
Google Chrome is a widely used web browser. A vulnerability in its WebRTC component, which handles real-time communication like video and audio calls, could allow a malicious website to access sensitive information from the browser's memory. This could lead to the exposure of private data or help attackers bypass security protections.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the WebRTC component of Google Chrome on macOS. The flaw is triggered when the browser processes a specially crafted HTML page, allowing a remote attacker to read data outside the intended buffer in the browser's process memory. This can lead to the disclosure of sensitive information or be used as a primitive in a multi-stage exploit to bypass memory layout randomization (ASLR). The issue is resolved in version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216 on Mac
Timeline
- 2026-05-27: patched: Stable channel update released for desktop
- 2026-05-28: disclosed: CVE published to NVD