EUVD-2026-50877
GHSA-f4qf-989f-24qq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryPage delivers malformed WebRTC content
-
ExploitTrigger heap out-of-bounds read in WebRTC
-
ExecutionLeak adjacent heap memory
-
ImpactExfiltrate disclosed sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled HTML page in a vulnerable Chrome build (UI:R - user interaction required, so there is no zero-click path) and the page must exercise the WebRTC code path that triggers the out-of-bounds read. No authentication and no special victim-side configuration are needed because WebRTC processing is reachable in default browser settings (PR:N), but exploitation is limited by the required user interaction, by the read-only (memory-disclosure) nature of the primitive per the description, and by Chrome's automatic-update mechanism which closes the window quickly for most users. |
| Impact | The signals conflict and should be weighed carefully. The supplied CVSS 3.1 score of 8.8 with C:H/I:H/A:H implies full compromise of confidentiality, integrity, and availability, but the description explicitly limits the primitive to an out-of-bounds memory READ and Chromium's own security team rated the bug Low severity - the CVSS full-impact triad appears inflated relative to a read-only disclosure. EPSS is low at 0.19% (9th percentile), the CVE is not on CISA KEV, and SSVC records exploitation: none and automatable: no, all pointing to low real-world urgency despite the high nominal CVSS. SSVC's 'technical impact: total' is the one signal aligned with the high CVSS but it is not corroborated by the description. Net: this is a high-CVSS-but-modest-real-risk item - patch it in the normal Chrome auto-update cycle rather than as an emergency, and verify the true impact (read vs. write) against the vendor advisory before treating it as RCE-grade. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebRTC content and lures a victim running a pre-151.0.7922.72 Chrome build to visit it via a phishing link, malvertising, or a compromised site. When the page loads, the WebRTC parser reads past a heap allocation, leaking adjacent process memory that could contain sensitive data or values useful for defeating ASLR. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Menu > Help > About Google Chrome) or by pushing the update through enterprise management, then relaunch the browser to load the patched build; the advisory is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Confirm managed fleets are not pinned to an older channel or running with auto-update disabled, the most common reason endpoints stay vulnerable. As an interim compensating control where patching is delayed, disabling WebRTC (via enterprise URL-blocklist policy or a WebRTC-blocking extension) removes the affected attack surface at the cost of breaking video conferencing and other real-time-communication features.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in WebRTC, the real-time audio/video/data communication stack Chromium ships for peer-to-peer media in the browser. WebRTC parses and processes attacker-influenceable media and signaling data, and a malformed input causes a read past the bounds of a heap allocation (CWE-122, heap-based buffer overflow manifesting as an out-of-bounds read). Because WebRTC processing can be reached from JavaScript/HTML content, a crafted page is sufficient to hit the vulnerable code path. The single affected product per the CPE data is the Chrome desktop browser (cpe:2.3:a:google:chrome:*), fixed in the 151.0.7922.72 stable channel build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs user interaction (UI:R); the primitive is an out-of-bounds read so confidentiality is limited (C:L) with a possible crash (A:L) and no integrity impact, matching Chromium's Low rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome's WebRTC component contains an out-of-bounds memory read vulnerability affecting all Chrome users; successful exploitation could disclose sensitive heap memory when employees visit a crafted website. Currently, no public exploit identified at time of analysis, with exploitation probability at 0.2% EPSS; however, the vulnerability's remote and unauthenticated nature, combined with Chrome's ubiquity in enterprise environments, warrants prompt remediation. Leadership should prioritize deployment of Chrome 151.0.7922.72 or later across the organization within one week.
Vendor-released patch: Chrome 151.0.7922.72 and later. No interim compensating controls available given the remote, unauthenticated attack vector; patch deployment is the primary mitigation strategy.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB