Description

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T00:18:28.660Z",
  "pubdate": "2026-09-02T00:18:28.660Z",
  "executiveSummary": "This vulnerability is an information leak flaw within the MediaCapture component of Google Chrome, specifically impacting versions prior to 152.0.7977.75. Classified with a Medium severity rating, this security deficiency allows a remote, unauthenticated attacker to induce the unauthorized disclosure of sensitive data through the rendering of a specially crafted HTML document. The vulnerability leverages the browser's processing of media streams to bypass existing privacy boundaries. Exploitation requires minimal interaction from a user, typically involving navigation to a malicious webpage, which then triggers the vulnerability to extract information from the client environment. The primary risk implication is the potential exposure of user-sensitive data or system state information that should otherwise remain encapsulated within the browser's sandbox. Because the exploit is triggered via web content, the attack vector is remote, necessitating defensive patching and vigilant browsing practices to mitigate unauthorized information harvesting by adversarial entities.",
  "technicalDetails": "The vulnerability resides within the MediaCapture implementation in the Chromium browser engine, which manages hardware-accelerated media input streams, such as microphone and camera access. The root cause pertains to improper validation and handling of media stream metadata or associated state information during the lifecycle of a MediaStream object. When a crafted HTML page leverages specific MediaCapture API calls in an unintended sequence or configuration, the browser fails to correctly enforce isolation boundaries, leading to an information leak.\nThe exploitation flow begins when an attacker hosts a malicious HTML page containing specifically orchestrated JavaScript that interfaces with the MediaCapture API. Upon visiting this page, the browser's rendering engine processes the crafted code, which triggers an edge case in the media processing pipeline. Because the MediaCapture component does not properly sanitize or verify the context of the requested media interactions, the internal state or sensitive data linked to the capture session is inadvertently exposed to the execution context of the malicious script.\nThis vulnerability does not require the attacker to have pre-existing privileges on the host system, as the attack is executed within the browser's sandboxed environment via web-delivered content. The malicious payload exploits the gap between the intended privacy constraints of the MediaCapture interface and the browser's internal data handling processes. Once the data is leaked to the script's execution context, it can be exfiltrated to a remote server controlled by the attacker via standard asynchronous requests (e.g., XMLHttpRequest or the Fetch API).\nAffected versions of Google Chrome include all builds preceding 152.0.7977.75. The impact of this post-exploitation scenario includes the unauthorized acquisition of browser-level information or metadata, which can be utilized for reconnaissance, tracking, or further targeted attacks against the user. Given the nature of MediaCapture APIs, the vulnerability essentially breaks the fundamental expectation of privacy between the web application's sandbox and the user's local hardware media streams. Mitigation relies heavily on the official vendor-supplied patch, as the flaw is deeply rooted in the C++ architecture of the MediaCapture subsystem within Chromium."
}