Description

Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:17:50.963Z",
  "pubdate": "2026-08-25T21:17:50.963Z",
  "executiveSummary": "This vulnerability involves an integer overflow condition within the WebRTC component of Google Chrome prior to version 152.0.7977.65. The flaw permits a remote attacker to potentially execute arbitrary code within the confines of the browser's sandbox environment. Exploitation is achieved through the delivery of a maliciously crafted HTML page to an unsuspecting user. Despite the Chromium project classifying the severity of this vulnerability as 'Low,' the potential for remote code execution (RCE) represents a significant security risk to the integrity and confidentiality of the browser session. Successful exploitation requires the user to interact with a site containing the malicious payload, which triggers the overflow during WebRTC media processing. The vulnerability is restricted by the sandbox, limiting the attacker's ability to gain full system access directly; however, it remains a critical vector for secondary exploitation or data exfiltration. All users running affected versions of Google Chrome are advised to update to the latest patched release to neutralize this attack surface.",
  "technicalDetails": "The root cause of this vulnerability lies in an integer overflow within the WebRTC subsystem of the Chromium codebase. Integer overflows occur when an arithmetic operation attempts to create a numeric value that exceeds the maximum storage capacity of the allocated integer type. In the context of WebRTC, this typically occurs during the calculation of memory buffer sizes, frame dimensions, or packet metadata processing. When the underlying arithmetic operation wraps around due to an integer overflow, it results in a smaller-than-intended memory allocation for the incoming data stream.\nThe exploitation flow begins when an attacker directs a target to a web page containing a specially crafted HTML file or JavaScript that interacts with the WebRTC API. By manipulating parameters within the WebRTC media pipeline—such as codec-specific headers or stream initialization configurations—the attacker induces the application to perform an undersized memory allocation. Once the allocation is constrained to an insufficient size, the subsequent media data processing functions write beyond the boundaries of the heap-allocated buffer. This heap-based buffer overflow can be leveraged to corrupt adjacent objects in memory.\nBy strategically crafting the heap layout, an attacker can overwrite critical control structures, such as function pointers, virtual method tables (vtable), or metadata used by the JavaScript engine's JIT (Just-In-Time) compiler. Corrupting these structures allows an attacker to redirect execution flow to attacker-controlled memory segments, potentially executing arbitrary code. Although the Chromium sandbox imposes significant security constraints—restricting access to OS-level system calls and sensitive file system areas—the ability to execute code within the browser process allows for potential circumvention of same-origin policies or the extraction of sensitive session information, including cookies and authentication tokens.\nThis vulnerability does not require authentication or elevated system privileges to trigger, making it highly effective against standard browser users via passive browsing or social engineering. The impact is limited to the browser process unless coupled with a secondary exploit targeting the sandbox or OS kernel. Because the vulnerability resides within the C++ implementation of WebRTC, it persists across different operating systems running the vulnerable Chromium versions. The remediation requires an update to version 152.0.7977.65 or later, which incorporates safer integer arithmetic checks or bounds-checking logic within the affected WebRTC processing modules."
}