Google Chrome CVE-2026-8016

Exploitation requires the victim to visit an attacker-controlled or compromised webpage containing crafted HTML/JavaScript that exercises specific WebRTC API sequences. No special Chrome configuration, features, or flags are required-WebRTC is enabled by default in all standard Chrome installations. The UI:R CVSS metric confirms mandatory user interaction (page visit) for exploitation. Attack complexity is Low (AC:L), suggesting reliable exploitation once the victim loads the page, without requiring race condition wins or brute-force attempts. No authentication required (PR:N) for the attacker. Exploitation is limited by Chrome's sandbox architecture (S:U-Unchanged scope), meaning successful code execution occurs within the restricted renderer process rather than with host system privileges. The sandbox prevents direct file system access, system API calls, and cross-process interference, significantly limiting post-exploitation impact compared to unsandboxed browsers or applications. Platform-specific sandbox implementations (seccomp-bpf on Linux, App Sandbox on macOS, restricted token on Windows) vary slightly in restrictiveness but all prevent immediate system-level compromise.

Risk assessment reveals conflicting severity signals requiring careful interpretation. CVSS 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R indicates network-accessible exploitation with low complexity but mandatory user interaction, achieving full confidentiality/integrity/availability impact within the sandboxed scope (S:U). However, Chromium's internal severity rating of 'Low' dramatically contradicts this, suggesting Chrome security team assessment found limited practical exploitability-possibly due to tight race conditions, heap layout requirements, or effective sandbox containment. The UI:R requirement (user must visit attacker-controlled page) and sandbox scope limitation (S:U) significantly reduce real-world risk compared to unauthenticated remote code execution on the host system. No CISA KEV listing indicates no confirmed active exploitation. No public POC identified, lowering immediate weaponization risk. EPSS data not provided, but typical Chrome sandbox escapes have lower exploitation rates than direct RCE. Conflicting severity ratings suggest this is a defense-in-depth issue rather than critical infrastructure threat-high theoretical impact but low observed exploitation likelihood. Priority should align with Chromium team's Low rating: patch during normal update cycles rather than emergency response.

An attacker creates a malicious website or compromises a legitimate site to host a crafted HTML page containing JavaScript that triggers the WebRTC use-after-free condition. When a user visits this page (via phishing email, malicious advertisement, or watering hole attack), the JavaScript initiates WebRTC peer connection setup with carefully timed object destruction and reuse, causing the freed memory to be accessed. The attacker leverages this memory corruption to redirect code execution within Chrome's renderer process sandbox, potentially exfiltrating browsing data from the current tab, manipulating page content, or establishing persistence within the sandboxed context. Full system compromise requires chaining with a separate sandbox escape vulnerability. No public POC exists at time of analysis.