EUVD-2026-34661
GHSA-p7mc-g528-g76m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebRTC subsystem (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read data across origin boundaries when a victim visits a crafted HTML page. The vulnerability carries a CVSS 6.5 Medium score with high confidentiality impact, but mandatory user interaction prevents automated mass exploitation - consistent with SSVC Automatable: no and an EPSS of 0.03% (10th percentile). No public exploit code exists and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Technical ContextAI
WebRTC (Web Real-Time Communication) is a browser-native API enabling peer-to-peer audio, video, and arbitrary data channels directly between browsers without plugins. Google Chrome's implementation prior to 149.0.7827.53 contains an 'inappropriate implementation' - the vendor's language for a logic or design flaw rather than a memory-safety issue. CWE-346 (Origin Validation Error) identifies the root cause class: the WebRTC subsystem fails to correctly enforce same-origin policy boundaries during media negotiation, ICE candidate handling, or data channel operations, enabling one origin's content to be observed by a distinct, attacker-controlled origin. This class of flaw can manifest as timing side-channels, direct data reads through misrouted streams, or error message leakage. The affected product is Google Chrome for desktop across all platforms (Windows, macOS, Linux) for all versions in the range covered by the EUVD entry 'Chrome 149.0.7827.53 <149.0.7827.53'.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later, as documented in the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Most desktop Chrome installations will receive this update automatically via Chrome's built-in updater; users should confirm their version via chrome://settings/help and restart the browser to finalize any pending update. For enterprise environments where immediate rollout is not feasible, two compensating controls are available with noted trade-offs: first, disabling WebRTC entirely via the enterprise policy flag WebRtcAllowed=false or chrome://flags will eliminate the attack surface but will break all real-time communication features (video conferencing, VoIP, peer-to-peer file transfer); second, applying URL allowlisting through Chrome's URLBlocklist enterprise policy to restrict browsing to known-safe domains reduces the likelihood of a victim visiting a malicious page but may disrupt legitimate workflows and does not eliminate the vulnerability for allowlisted sites that could themselves host or redirect to malicious WebRTC content.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today