Google Chrome CVE-2026-84348

Exploitation requires a victim to visit an attacker-controlled HTML page using a vulnerable version of Google Chrome (prior to 152.0.7977.75) on a desktop platform. The MediaCapture component must be invoked by the page. No authentication or elevated privileges are required from the attacker's side (PR:N). The critical limiting condition is mandatory user interaction (UI:R): the victim must navigate to or be redirected to the crafted page. Whether the victim must also grant camera/microphone permission to trigger the leak is not specified in available public sources (Chromium issue 518100026 is restricted), so permission-grant requirements cannot be confirmed or ruled out. Exploitation is limited to desktop Chrome; mobile and Chromium-based browsers not derived from the same codebase are not confirmed affected.

The CVSS 6.5 (Medium) score reflects a network-delivered attack that nonetheless requires user interaction (UI:R), a meaningful friction point that distinguishes this from fully automated, wormable risks. The C:H metric indicates potentially significant confidentiality impact - media streams or captured device output leaking to an attacker would be serious - but integrity and availability are unaffected (I:N/A:N). No EPSS score was provided in the available intelligence, and the vulnerability does not appear in CISA KEV, confirming no known active exploitation at time of analysis. The Chromium security team itself rated severity as Medium, consistent with the UI:R gating requirement. Because Chrome is ubiquitously deployed, even organizations running modest IT operations should treat timely patching as standard hygiene rather than an emergency response. No public exploit code has been identified, further reducing short-term exploitation probability. The primary real-world risk vector is a drive-by or phishing scenario where a victim is lured to a malicious page.

An attacker crafts a malicious HTML page that silently invokes the MediaCapture API to trigger the information disclosure path, then hosts it at a convincing domain or embeds it in a phishing email. When a victim using a vulnerable Chrome version visits the page - without needing to grant explicit permissions for the leak to occur, depending on the precise flaw - the attacker's JavaScript receives sensitive captured data from the victim's browser context. No public exploit code exists at time of analysis, so exploitation would currently require independent vulnerability research to reproduce.