Description

Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:18:21.107Z",
  "pubdate": "2026-08-25T21:18:21.107Z",
  "executiveSummary": "A medium-severity security vulnerability exists within the Google Chrome browser related to the GetUserMedia API.\nThe vulnerability stems from an incomplete cleanup process after a device access operation, which can be exploited by an attacker who has successfully compromised the renderer process.\nBy leveraging social engineering techniques to trick a user into interacting with a crafted HTML page, an attacker can access sensitive information that should have been cleared from memory or browser state.\nThis flaw resides in the handling of media stream lifecycle management, specifically within the Chromium renderer.\nThe risk implication is unauthorized data exfiltration, where the attacker may retrieve potentially sensitive metadata or information captured during the media stream session.\nExploitation requires a two-stage approach: the initial compromise of the renderer process and subsequent user interaction via social engineering to trigger the vulnerable code path.\nUsers and organizations are advised to update to version 152.0.7977.65 or later to mitigate this risk.",
  "technicalDetails": "The vulnerability exists in the implementation of the GetUserMedia API within the Chromium engine. GetUserMedia is a critical component of the MediaStream API, responsible for requesting user permission and accessing hardware devices such as microphones and cameras.\nThe root cause of this issue is an incomplete cleanup process, indicating that state information, session data, or memory buffers associated with the media stream are not correctly wiped or deallocated upon the termination or modification of a stream context. When a site requests access to media devices, the browser creates a handle for the device input. If the cleanup logic fails, stale data remnants may persist in memory locations accessible to the renderer process.\nAn attacker who has already achieved remote code execution within the renderer process can exploit this deficiency. Because the renderer process is sandboxed, the attacker's objective is to escalate or exfiltrate data from within the browser environment. In this scenario, the attacker deploys a crafted HTML page designed to initiate a specific sequence of media stream requests and subsequent teardowns.\nThe attack flow proceeds as follows: First, the attacker compromises the renderer process through a secondary exploit. Second, the attacker utilizes social engineering—such as a deceptive UI prompt or convincing context—to induce the user to interact with the crafted HTML page. Third, the crafted page invokes GetUserMedia in a manner that triggers the faulty cleanup logic. Finally, by monitoring the stale state or memory residues left behind by the incomplete cleanup, the attacker exfiltrates the sensitive information, such as session-specific identifiers or media-related metadata.\nThis vulnerability is restricted to Chromium versions prior to 152.0.7977.65. The vulnerability does not require authentication to the target system itself; rather, it requires the attacker to successfully perform process-level code execution within the browser's renderer sandbox. The impact is primarily categorized as information disclosure, as the incomplete cleanup allows for the bypass of security boundaries meant to isolate media device data from unauthorized inspection after a session has concluded."
}