EUVD-2026-35267
GHSA-wx6h-3mh7-h885
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure victim to crafted page
-
DeliveryTrigger prior GPU process compromise
-
ExploitInvoke WebRTC from attacker JS
-
InstallOut-of-bounds read leaks heap layout
-
C2Shape allocations into heap corruption
-
ExecuteChain to sandbox escape
-
ImpactAchieve broader browser compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete preconditions stated in or implied by the advisory: (1) the attacker must have already compromised the Chrome GPU process via a separate prior vulnerability, meaning this bug is a chain link, not an entry point; (2) the victim must load attacker-controlled HTML in Chrome (UI:R - user interaction), typically by clicking a link or visiting a malicious site; (3) the browser must be a Chrome desktop build below 149.0.7827.103 with WebRTC enabled (the default). Limiting factors: AC:H indicates non-trivial exploitation complexity (likely heap grooming and timing dependencies), the GPU-process prerequisite eliminates drive-by single-bug exploitation, and the scope is unchanged (S:U) so the bug alone does not cross the sandbox boundary without additional primitives. |
| Impact | The CVSS 7.5 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-impact but high-complexity remote bug that requires user interaction (visiting a crafted page) and, per the description, a precondition that the GPU process is already compromised - a meaningful limiter that CVSS does not fully model. There is no KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so absolute exploitation probability cannot be quantified here. Realistically this is a secondary-stage primitive used inside a multi-bug Chrome exploit chain (typical of targeted browser attacks), not a wormable internet-facing flaw; patching is still high priority for desktop fleets because Chrome bugs are routinely chained by commercial spyware and criminal actors once details surface. Note: the description's 'compromised the GPU process' phrasing implies a prerequisite that conflicts with the unauthenticated CVSS rating - defenders should treat this as a chain component, not a single-shot RCE. |
| Exploit ScenarioDerived | An attacker lures a target to a crafted HTML page (phishing link, malvertising, or watering-hole) that first triggers a separate GPU-process vulnerability to gain code execution inside the GPU sandbox. From that foothold, the page invokes WebRTC APIs to trigger the out-of-bounds read, leaking heap layout and then shaping allocations to drive heap corruption - used as the next link in a sandbox-escape chain toward renderer or browser-process compromise. No public exploit identified at time of analysis, though Chrome WebRTC bugs of this class have historically been weaponized in commercial spyware chains. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Out-of-bounds read in the WebRTC component of Google Chrome before 149.0.7827.103 enables a remote attacker who has already compromised the GPU process to escalate into heap corruption via a crafted HTML page. Google rates this High severity and a vendor patch is available; no public exploit identified at time of analysis. The flaw is a chained-exploitation primitive rather than a standalone RCE, requiring a prior sandbox-adjacent foothold plus user interaction.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.103 (stable channel) - upgrade all desktop installs per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html and track upstream details via the Chromium issue tracker entry at https://issues.chromium.org/issues/514671098. Force a browser restart after update since Chrome only loads the new binary on relaunch, and audit Chromium-based products (Edge, Brave, Electron apps) for their corresponding patched builds. As a compensating control until patching completes, restrict or disable WebRTC where it is not business-critical (enterprise policy WebRtcAllowLegacyTLSProtocols / URL-based WebRTC blocking, or extensions like uBlock Origin's 'prevent WebRTC leak' toggle) - trade-off is that video conferencing, voice chat, and some collaboration apps will break. Enforce site isolation and the GPU sandbox (default-on, but verify chrome://gpu) to make the prerequisite 'GPU process compromise' harder to obtain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebRTC is the real-time communications stack embedded in Chromium that handles audio, video, and data channels through SRTP, ICE, and DTLS pipelines, and it runs partially within the GPU process for hardware-accelerated media. The root cause is CWE-125 (Out-of-bounds Read), where the WebRTC code reads memory past the end of an allocated buffer, leaking adjacent heap contents that can be steered into heap corruption. Because the bug is reachable from a renderer or GPU context driven by an attacker-controlled HTML page, it provides a memory disclosure primitive useful for defeating ASLR and for crafting precise heap grooms in a sandbox escape chain. Affected component is Chromium's WebRTC in Chrome prior to 149.0.7827.103 across desktop channels per the Chrome Releases blog.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A high-severity vulnerability in Google Chrome (CVE-2026-11667) could allow attackers who have already compromised the GPU process to break out of the sandbox and corrupt system memory through malicious web pages, potentially leading to full system compromise. While no public exploit code has been identified, the attack requires only user interaction with an attacker-controlled webpage, making all Chrome users in the organization potential targets. A vendor patch is available and must be deployed immediately to all Chrome installations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Use-After-Free and Memory Safety Flaws
View all 74Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB