EUVD-2026-91715
GHSA-cj2x-hj5c-4f82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted WebRTC page
-
DeliveryDeliver malicious HTML to browser
-
ExploitTrigger heap overflow in WebRTC
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAchieve code execution within sandbox boundary
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML that exercises Chrome's WebRTC component - meaning the attack is drive-by but gated on user interaction (UI:R): the user must navigate to or open the malicious page. No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected since WebRTC is enabled by default. The principal limiting factor is that code execution is confined to the renderer sandbox (scope unchanged); escaping to the host OS would require chaining an additional sandbox-escape flaw. Only Chrome builds prior to 154.0.8037.97 are vulnerable, so patched/auto-updated installations are not exposed. |
| Impact | Signals are consistent and point to a serious-but-not-urgent issue. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) - network-reachable, low attack complexity, no privileges, but requiring user interaction (the victim must open a crafted page). SSVC largely agrees: Technical Impact is 'total', yet Exploitation is 'none' and Automatable is 'no', which downgrades operational urgency. EPSS reinforces this with a low 0.25% exploitation probability (15th percentile), and the CVE is NOT in CISA KEV and has no identified public exploit. The description's phrase 'execute arbitrary code inside the sandbox' is a crucial mitigating factor the raw 8.8 obscures: S:U (scope unchanged) is consistent with code execution confined to the renderer sandbox rather than a full host takeover. Realistically, this is NOT a drop-everything priority - it is a high-severity memory-corruption bug that, absent a chained sandbox escape and absent any current exploitation signal, carries moderate real-world risk. Browser renderer bugs can be weaponized quickly if a public exploit emerges, so patch promptly via normal cycles, but the current evidence does not indicate active or imminent mass exploitation. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious WebRTC content and lures a victim running an unpatched Chrome build to visit it (e.g., via phishing link or malvertising). Loading the page triggers a heap buffer overflow in Chrome's WebRTC component, letting the attacker run arbitrary code within the renderer sandbox. No public proof-of-concept exploit is currently identified, and full host compromise would additionally require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Heap-based buffer overflow in Google Chrome's WebRTC component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; all Chrome builds prior to 154.0.8037.97 on desktop and mobile platforms are affected. Successful exploitation requires user interaction (the victim must navigate to or open the attacker-controlled page), but no authentication or prior privileges are needed, and WebRTC is enabled by default. Impact is high for confidentiality, integrity, and availability within the renderer process, though the attack scope is unchanged - breaking out to the host operating system would require chaining a separate sandbox-escape flaw. Exploitation signals are currently weak: EPSS is only 0.25% (15th percentile), CISA SSVC rates exploitation as 'none', and no public exploit code has been identified at time of analysis; a vendor patch is available.
RemediationAI
Upgrade to Google Chrome 154.0.8037.97 or later - the vendor-released patch that resolves CVE-2026-103631; the fix is distributed through Chrome's standard stable-channel update mechanism (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html and Chromium issue 567088927). On managed fleets, force an update check and restart browsers rather than relying on users to relaunch, and verify the reported version on the chrome://version page, since Chrome frequently defers applying an update until the next restart. Where immediate patching is impossible, there is no supported enterprise policy that cleanly disables WebRTC as a whole; blocking WebRTC at the network layer (UDP/STUN/TURN traffic) or via extension-based blockers measurably reduces exposure but breaks video conferencing, screen sharing, and real-time data channels, and is only partially effective since the vulnerable parsing path can be reached with attacker-supplied session data. The strongest compensating control is the renderer sandbox itself: exploitation is confined to the renderer process under the assessed vector, so maintaining strict site isolation, disabling unnecessary extensions, and prioritizing browser restarts limits the practical consequence of an unpatched window. No vendor-released workaround short of upgrading fully removes the vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in WebRTC, the real-time communications framework Chrome uses for peer-to-peer audio, video, and data channels, including STUN/TURN, ICE negotiation, SDP parsing, RTP/RTCP handling, and DTLS-SRTP. Heap overflows of this class typically arise when a length or index derived from attacker-supplied session data is not validated against the actual size of a heap allocation, allowing adjacent memory to be overwritten. Because WebRTC media and signaling parsing occurs inside the renderer process (which is itself sandboxed), the CVSS scope is Unchanged (S:U) despite the High integrity/confidentiality/availability impact - the immediate blast radius is the renderer, not the host. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* reflects the fact that Google does not enumerate per-version CPEs for Chrome, so any build below the fixed release should be treated as potentially vulnerable. Chromium security severity is rated High, consistent with the 8.8 CVSS base score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted web page is network-delivered with low complexity and no privileges, but requires the user to open it (UI:R); code execution stays within the renderer sandbox so scope is unchanged (S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome builds prior to 154.0.8037.97 on desktop and mobile contain a heap-based buffer overflow in the WebRTC component that can allow a remote attacker to run code inside the browser's renderer sandbox when a user simply opens a malicious web page. Because Chrome is broadly deployed across the workforce and exploitation requires only routine browsing activity, every unpatched endpoint is an opportunistic target, although reaching the underlying operating system would require chaining a separate sandbox-escape flaw and no active exploitation or public exploit code has been identified at time of analysis. Leadership should treat this as a manageable but time-sensitive patching obligation rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB