Description

Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:17:46.390Z",
  "pubdate": "2026-08-25T21:17:46.390Z",
  "executiveSummary": "This vulnerability involves a buffer overflow flaw within the WebRTC component of Google Chrome, specifically identified in versions prior to 152.0.7977.65. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code within the constraints of the browser sandbox by enticing a victim to visit a maliciously crafted HTML page. Although the Chromium project classifies this as a Medium severity issue, the potential for arbitrary code execution poses a significant risk to user data confidentiality, integrity, and availability. Successful exploitation does not require prior authentication, relying instead on user interaction via navigation to a compromised or attacker-controlled website. The primary security implication is the subversion of the browser environment's safety mechanisms, which could be leveraged as a precursor to more complex, multi-stage attacks targeting the underlying operating system if sandbox escape vulnerabilities are chained with this primitive.",
  "technicalDetails": "The vulnerability resides within the WebRTC (Web Real-Time Communication) implementation in Chromium, a suite of protocols and APIs that enable peer-to-peer data, audio, and video communication. A buffer overflow occurs when an application writes data past the boundary of a fixed-length memory buffer, typically leading to memory corruption. In this specific instance, the issue manifests during the processing of network packets or signaling data handled by the WebRTC stack, where insufficient bounds checking allows an attacker to overwrite adjacent memory segments.\nThe attack flow begins when an attacker hosts a specially crafted HTML page containing malicious WebRTC signaling payloads. When a victim navigates to this page using an affected version of Google Chrome (prior to 152.0.7977.65), the browser's WebRTC component initiates the processing of the malicious data. Because the component fails to properly validate the size of incoming data structures before copying them into memory buffers, the payload triggers an out-of-bounds write. This allows an attacker to manipulate the execution flow by overwriting critical memory locations, such as function pointers or return addresses stored on the stack or in the heap.\nBy precisely controlling the contents of the overflow, the attacker can redirect the instruction pointer to arbitrary shellcode or a ROP (Return-Oriented Programming) chain. While the Chromium sandbox imposes significant restrictions on the attacker's ability to interact directly with the operating system kernel or filesystem, successful exploitation provides the attacker with execution capabilities within the browser's sandboxed renderer process. This allows for the theft of local browser data, session cookies, or the exploitation of additional vulnerabilities—such as kernel-level flaws or sandbox escape exploits—to transition from restricted code execution to full system compromise. The vulnerability is triggered remotely and requires no authentication from the victim, making it highly effective when deployed via social engineering or malicious advertisements that redirect users to the exploit-laden landing page."
}