CVE-2026-11667: Google Chrome WebRTC RCE Vulnerability

CVE-2026-11667 Overview

CVE-2026-11667 is an out-of-bounds read vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.103. The flaw allows a remote attacker who has already compromised the GPU process to potentially exploit heap corruption through a crafted HTML page. Google classifies the Chromium security severity as High, and the CVSS v3.1 base score is 7.5. The vulnerability is tracked under CWE-125 (Out-of-bounds Read) and affects Chrome installations across Windows, macOS, and Linux.

Critical Impact
An attacker who has compromised the renderer's GPU process can trigger heap corruption via crafted HTML, enabling potential sandbox escape and arbitrary code execution in the browser context.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome installations on Apple macOS, Microsoft Windows, and Linux
Downstream Chromium-based browsers that share the WebRTC stack

Discovery Timeline

2026-06-09 - CVE-2026-11667 published to NVD
2026-06-09 - Last updated in NVD database
2026-06 - Google releases stable channel update for desktop containing the fix (Google Chrome Desktop Update)

Technical Details for CVE-2026-11667

Vulnerability Analysis

The vulnerability resides in the WebRTC (Web Real-Time Communication) implementation within Google Chrome. WebRTC handles real-time audio, video, and data channels directly in the browser, exposing a wide attack surface to remote web content. An out-of-bounds read in this component allows code to access memory beyond the bounds of an allocated buffer.

Exploitation requires the attacker to have first compromised the GPU process. From that foothold, a crafted HTML page can drive WebRTC code paths that read past valid buffer boundaries, leading to heap corruption. Successful exploitation can disclose sensitive memory contents or enable arbitrary code execution within the affected browser process. The Chromium project tracks the underlying defect in the Chromium Issue Tracker Entry.

Root Cause

The root cause is improper bounds checking in a WebRTC code path that reads from a heap-allocated buffer. The defect maps to CWE-125. When the read operation crosses the intended buffer boundary, adjacent heap metadata or object state can be observed and manipulated, corrupting the heap.

Attack Vector

The attack vector is network-based and requires user interaction in the form of visiting a crafted HTML page. The attacker must already control the GPU process, raising attack complexity. After meeting that precondition, a malicious page triggers the vulnerable WebRTC path. No verified public proof-of-concept exists at the time of writing, and the EPSS probability of exploitation in the wild is low.

No verified exploitation code is publicly available for this issue. See the Chromium Issue Tracker Entry for technical details once Google removes the access restriction.

Detection Methods for CVE-2026-11667

Indicators of Compromise

Chrome renderer or GPU process crashes referencing WebRTC modules in crash dumps and Windows Event Logs
Outbound connections from Chrome to unfamiliar STUN, TURN, or signaling endpoints initiated by unattended sessions
Spawning of unexpected child processes from chrome.exe following navigation to untrusted sites

Detection Strategies

Inventory Chrome installations and flag any build below 149.0.7827.103 across Windows, macOS, and Linux endpoints
Monitor browser process telemetry for anomalous memory access violations and GPU process restarts correlated with WebRTC activity
Correlate web proxy logs with endpoint telemetry to identify users visiting low-reputation sites that initiate WebRTC sessions

Monitoring Recommendations

Centralize browser crash reports and process telemetry into a SIEM for trend analysis
Alert on Chrome child processes invoking shells, scripting engines, or downloading executables after page loads
Track Chrome version inventory continuously and alert when endpoints drift behind the current stable channel

How to Mitigate CVE-2026-11667

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into all renderer and GPU processes
Validate that downstream Chromium-based browsers in the environment have absorbed the upstream fix

Patch Information

Google released the fix in the stable channel update documented in the Google Chrome Desktop Update. Upgrading to Chrome 149.0.7827.103 or later remediates the vulnerability. Enterprises using managed deployment should push the update through Group Policy, Jamf, Intune, or equivalent management tooling.

Workarounds

Enforce Chrome auto-update via enterprise policy and block execution of older Chrome binaries until patched
Restrict access to untrusted sites through web filtering while patch deployment completes
Disable WebRTC via enterprise policy where business use cases do not require real-time communication

bash

# Enforce minimum Chrome version via enterprise policy (Windows registry example)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "149.0.7827.103" /f

# Disable WebRTC peer connection where not required
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebRtcUdpPortRange /t REG_SZ /d "" /f