EUVD-2026-34661
GHSA-p7mc-g528-g76m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebRTC subsystem (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read data across origin boundaries when a victim visits a crafted HTML page. The vulnerability carries a CVSS 6.5 Medium score with high confidentiality impact, but mandatory user interaction prevents automated mass exploitation - consistent with SSVC Automatable: no and an EPSS of 0.03% (10th percentile). No public exploit code exists and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Technical ContextAI
WebRTC (Web Real-Time Communication) is a browser-native API enabling peer-to-peer audio, video, and arbitrary data channels directly between browsers without plugins. Google Chrome's implementation prior to 149.0.7827.53 contains an 'inappropriate implementation' - the vendor's language for a logic or design flaw rather than a memory-safety issue. CWE-346 (Origin Validation Error) identifies the root cause class: the WebRTC subsystem fails to correctly enforce same-origin policy boundaries during media negotiation, ICE candidate handling, or data channel operations, enabling one origin's content to be observed by a distinct, attacker-controlled origin. This class of flaw can manifest as timing side-channels, direct data reads through misrouted streams, or error message leakage. The affected product is Google Chrome for desktop across all platforms (Windows, macOS, Linux) for all versions in the range covered by the EUVD entry 'Chrome 149.0.7827.53 <149.0.7827.53'.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later, as documented in the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Most desktop Chrome installations will receive this update automatically via Chrome's built-in updater; users should confirm their version via chrome://settings/help and restart the browser to finalize any pending update. For enterprise environments where immediate rollout is not feasible, two compensating controls are available with noted trade-offs: first, disabling WebRTC entirely via the enterprise policy flag WebRtcAllowed=false or chrome://flags will eliminate the attack surface but will break all real-time communication features (video conferencing, VoIP, peer-to-peer file transfer); second, applying URL allowlisting through Chrome's URLBlocklist enterprise policy to restrict browsing to known-safe domains reduces the likelihood of a victim visiting a malicious page but may disrupt legitimate workflows and does not eliminate the vulnerability for allowlisted sites that could themselves host or redirect to malicious WebRTC content.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today