CVE-2026-103631: Google Chrome WebRTC Buffer Overflow

CVE-2026-103631 Overview

CVE-2026-103631 is a heap buffer overflow [CWE-122] in the WebRTC component of Google Chrome prior to version 154.0.8037.97. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page. Google's Chromium security team rated the severity as High.

The flaw affects the real-time communications stack that handles audio, video, and data channels in the browser. Exploitation requires user interaction, specifically visiting an attacker-controlled page. Code execution is contained within the renderer sandbox, but attackers typically chain such flaws with sandbox escapes to achieve full system compromise.

Critical Impact
Remote attackers can trigger arbitrary code execution in the Chrome renderer sandbox through a single malicious web page, enabling browser-based exploitation and potential chaining with sandbox escape vulnerabilities.

Affected Products

Google Chrome versions prior to 154.0.8037.97 (Desktop)
Chromium-based browsers that embed the vulnerable WebRTC component
Applications using the affected Chromium WebRTC library

Discovery Timeline

2026-10-02 - CVE-2026-103631 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103631

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Chrome's WebRTC implementation. WebRTC processes untrusted media and data channel inputs directly from remote peers and from JavaScript APIs exposed to web content. A crafted HTML page can supply input that exceeds the bounds of a heap-allocated buffer during WebRTC processing.

The resulting out-of-bounds write corrupts adjacent heap memory. An attacker who controls the overflowed data can overwrite function pointers, object vtables, or heap metadata to redirect execution. Successful exploitation yields arbitrary code execution within the renderer process sandbox.

User interaction is required because the victim must load the attacker-controlled page. However, drive-by download campaigns, malvertising, and watering-hole attacks routinely satisfy this requirement at scale.

Root Cause

The root cause is a missing or incorrect bounds check during WebRTC data handling, categorized as [CWE-122] Heap-based Buffer Overflow. The specific function has not been publicly disclosed. Technical details are tracked in Chromium Issue #567088927, which remains restricted pending broader patch adoption.

Attack Vector

Attackers deliver the exploit through a crafted HTML page that invokes WebRTC APIs with malicious parameters. Delivery mechanisms include compromised websites, phishing links, malicious advertisements, and iframe injection on vulnerable sites. The exploit executes when the victim's browser parses the page and initializes the WebRTC subsystem.

Code execution occurs inside the renderer sandbox. Attackers typically chain the primitive with a separate sandbox escape to achieve code execution at the user's privilege level on the host operating system.

No public proof-of-concept has been released and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date. See the Google Chrome Stable Update advisory for vendor-published details.

Detection Methods for CVE-2026-103631

Indicators of Compromise

Chrome renderer process crashes or unexpected restarts correlated with visits to untrusted sites that initiate WebRTC sessions
Outbound WebRTC-related connections (STUN, TURN, SRTP) to unrecognized infrastructure immediately preceding renderer instability
Child process creation from chrome.exe renderer processes that spawn shells, scripting hosts, or LOLBins
Browser versions reporting below 154.0.8037.97 in endpoint inventory telemetry

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 154.0.8037.97 for immediate remediation
Monitor renderer process behavior for anomalous memory access patterns, unexpected module loads, or post-exploitation activity following WebRTC initialization
Correlate web proxy logs with endpoint telemetry to identify users visiting sites that triggered browser crashes

Monitoring Recommendations

Enable browser crash reporting and forward dumps to a centralized analysis pipeline
Alert on Chrome renderer processes spawning cmd.exe, powershell.exe, wscript.exe, or similar binaries
Track WebRTC traffic to domains and IP ranges not associated with sanctioned communications platforms

How to Mitigate CVE-2026-103631

Immediate Actions Required

Update Google Chrome to version 154.0.8037.97 or later on all managed endpoints
Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have ingested the upstream WebRTC fix and are running patched builds
Force browser restarts through enterprise management tooling to ensure the updated binary is loaded
Audit extensions and embedded applications that bundle their own Chromium runtime for exposure

Patch Information

Google released the fix in the Chrome Stable channel at version 154.0.8037.97. Enterprise administrators should deploy the update through group policy, MDM, or the Chrome Browser Cloud Management console. Full details are published in the Google Chrome Stable Update advisory.

Workarounds

Restrict WebRTC functionality through enterprise policy such as WebRtcAllowLegacyTLSProtocols and URLBlocklist entries for untrusted sites until patching is complete
Deploy site isolation and strict Content Security Policy on internally hosted applications that rely on WebRTC
Use network-level controls to limit outbound STUN, TURN, and SRTP traffic to approved service providers
Apply browser hardening baselines that disable unneeded WebRTC features for user populations that do not require them

bash

# Chrome enterprise policy example (Windows registry) to disable WebRTC non-proxied UDP
# Reduces attack surface while patching is rolled out
reg add "HKLM\Software\Policies\Google\Chrome" /v WebRtcUdpPortRange /t REG_SZ /d "" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v WebRtcLocalIpsAllowedUrls /t REG_SZ /d "" /f