Description

Incorrect authorization in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:08.717Z",
  "pubdate": "2026-08-25T21:18:08.717Z",
  "executiveSummary": "A vulnerability classified as an incorrect authorization flaw exists within the GetUserMedia API implementation in Google Chrome prior to version 152.0.7977.65.\nThe vulnerability enables a remote attacker to bypass existing security constraints and gain unauthorized access to sensitive information.\nThe scope of impact involves unauthorized data exfiltration, which potentially compromises user privacy by allowing access to media streams without explicit or correct authorization.\nThis issue is rated as Medium severity by the Chromium security team, indicating a significant risk to user confidentiality.\nExploitation requires the victim to interact with a crafted HTML page, often delivered via malicious websites or social engineering campaigns.\nNo specific authentication is required from the attacker to initiate the exploitation process, as the vulnerability exists within the browser's internal logic for permission handling.",
  "technicalDetails": "The vulnerability resides within the GetUserMedia implementation of the Chromium engine, specifically regarding the authorization and permission request flow for media capture devices.\nGetUserMedia is a critical web API that allows web applications to access media input devices such as cameras and microphones. Proper implementation requires rigorous checks to ensure that permission is explicitly granted by the user and that the request originates from a trusted context.\nIn versions prior to 152.0.7977.65, the authorization logic failed to correctly validate or enforce the required permission states, creating a window where an unauthorized request could be fulfilled without meeting the standard security requirements.\nThe exploitation process typically follows this flow: First, an attacker hosts a crafted HTML page designed to invoke the GetUserMedia API. Second, when a victim navigates to this page using a vulnerable version of Google Chrome, the browser's flawed authorization module fails to correctly verify the request context or the user's intent.\nBecause of this validation failure, the browser proceeds to interface with the hardware abstraction layer to initiate a media stream. This allows the crafted page to silently or deceptively gain access to sensitive media data that the user may not have intended to share.\nThe root cause is identified as an incorrect authorization state management within the Chromium media stream processing pipeline. This flaw effectively bypasses the browser's security boundaries between the web origin and the local device hardware.\nThis is an unauthenticated, remote attack scenario. It requires no elevated privileges from the attacker; the requirement is solely the victim's interaction with the malicious content. The impact is primarily the breach of confidentiality regarding the victim's audio or visual environment captured by the hardware.\nPost-exploitation, the attacker is able to exfiltrate the stream data through standard network protocols controlled by the HTML page. This enables the remote acquisition of potentially sensitive information without the user's informed consent."
}