EUVD-2026-50633
GHSA-g442-2whp-xfm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JS drives WebRTC path
-
ExploitTrigger use-after-free / heap corruption
-
ExecutionAchieve code execution in renderer
-
ImpactChain sandbox escape for full compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in a vulnerable Chrome build (prior to 151.0.7922.72) and requires the WebRTC code path to be reachable - WebRTC APIs are available to any page by default, so no special browser configuration is needed. The primary limiting factor is user interaction (UI:R): the target must be induced to visit a crafted HTML page (direct link, malvertising, or compromised site). No authentication is required (PR:N). Practical exploitation is further constrained by the need to reliably groom the heap and, for a full breakout, to chain a separate renderer-sandbox escape - neither of which is provided by this bug alone. |
| Impact | The signals partially conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H) yields 8.8 High and reflects a network-reachable, low-complexity, unauthenticated bug needing only that a user visit a page. However, Chromium itself rated the security severity only Medium, and EPSS is 0.18% (8th percentile) with no KEV listing and no public exploit - suggesting real-world exploitation risk is currently low, not the emergency a raw 8.8 implies. Renderer UAFs are historically the most exploited Chrome bug class and are frequently chained with a sandbox escape, so the ceiling is high, but exploitation typically requires nontrivial engineering (heap grooming) that the CVSS AC:L metric understates. Net: patch promptly on normal Chrome update cadence, but this is not evidence of active mass exploitation. Key limiter: UI:R means the victim must be induced to load attacker content. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) containing crafted JavaScript that drives WebRTC into the vulnerable object-lifecycle path. When a victim running a pre-151.0.7922.72 Chrome visits, the use-after-free corrupts the heap and the attacker attempts to gain code execution or leak memory in the renderer. No public proof-of-concept has been identified, and any real-world attack would likely need to be chained with a sandbox escape for full compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), indicating no observed weaponization despite the high CVSS.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel; the fix is delivered via Chrome's automatic updater, so verify at chrome://settings/help and relaunch to apply, since the update is inert until restart. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, push the update through your enterprise policy/MDM to force the relaunch. If patching must be delayed, compensating controls include disabling or restricting WebRTC via enterprise policy (which breaks legitimate video-conferencing/RTC apps that rely on it) and limiting browsing to trusted sites through web filtering to reduce exposure to attacker-controlled HTML; both are stopgaps only. Users of other Chromium-based browsers should apply their vendor's build that incorporates the equivalent Chromium fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in WebRTC, the real-time peer-to-peer audio/video/data-channel stack built into Chromium and exposed to any web page via JavaScript APIs (RTCPeerConnection, data channels, media negotiation). The root cause is CWE-416 (Use-After-Free): an object's lifecycle is mishandled so that memory is freed while a dangling reference remains, and subsequent access corrupts the heap. Because WebRTC processing runs in the sandboxed renderer, a crafted HTML/JS page can drive the vulnerable code path without any plugin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (desktop Stable channel), and the vendor tags (Memory Corruption, Use After Free, Information Disclosure) align with the classic UAF-to-info-leak/RCE primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a web page with no auth, but reliable UAF exploitation needs heap grooming (AC:H) and victim must visit the page (UI:R).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A heap corruption vulnerability in Google Chrome's WebRTC component (CVE-2026-17884) enables remote code execution when users visit a malicious webpage, directly compromising Chrome instances across the organization. With CVSS 8.8 severity and broad Chrome adoption, this represents a significant endpoint security risk; however, observed exploitation probability remains minimal (EPSS 0.2%). Immediate patching is required to close this high-severity attack surface.
Vendor-released patch: Google Chrome 151.0.7922.72
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB