CVE-2026-17795 Overview
CVE-2026-17795 is an inappropriate implementation flaw in the GetUserMedia API of Google Chrome versions prior to 151.0.7922.72. The vulnerability allows a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HTML page. Google rates the Chromium security severity as Medium. The issue is classified under CWE-20: Improper Input Validation.
Critical Impact
An attacker with a compromised renderer can bypass the same-origin policy through GetUserMedia, exposing data from other web origins loaded by the victim's browser.
Affected Products
- Google Chrome for Desktop versions prior to 151.0.7922.72
- Chromium-based browsers incorporating the vulnerable GetUserMedia implementation
- Downstream distributions that had not integrated the July 2026 stable channel update
Discovery Timeline
- 2026-07-30 - CVE-2026-17795 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17795
Vulnerability Analysis
The vulnerability resides in Chrome's implementation of the GetUserMedia Web API, which provides web pages access to microphone and camera streams. An inappropriate implementation permits data belonging to one origin to be accessed from another, breaking the browser's origin isolation guarantees. Exploitation requires a prerequisite compromise of the renderer process, meaning the attacker must first achieve code execution inside the sandboxed renderer. Once inside, the attacker leverages the flawed media API path to obtain cross-origin content that should be inaccessible.
The Chromium Issue Tracker Entry and Google Chrome Update Announcement document the fix landing in the stable channel update.
Root Cause
The root cause is improper validation in the GetUserMedia code path, tracked as [CWE-20]. The implementation does not correctly enforce origin boundaries when handling media stream requests originating from a compromised renderer. This allows references or handles associated with one origin to yield data belonging to another origin loaded in the same browser session.
Attack Vector
Attackers chain this bug with a prior renderer exploit. After gaining execution in the renderer process through a separate vulnerability, the attacker serves a crafted HTML page that invokes the GetUserMedia API in a way that triggers the flawed logic. The result is a read primitive across origin boundaries, which can expose authenticated content, tokens, or session data rendered from other sites.
No verified proof-of-concept code is publicly available. Refer to the Chromium issue tracker for technical details as the vendor discloses them.
Detection Methods for CVE-2026-17795
Indicators of Compromise
- Chrome browser processes running versions earlier than 151.0.7922.72 in the environment
- Unexpected getUserMedia invocations from pages that do not require camera or microphone functionality
- Renderer process crashes or anomalous child process spawns preceding suspicious network egress
Detection Strategies
- Inventory installed Chrome and Chromium-based browser versions across managed endpoints and flag builds older than 151.0.7922.72.
- Correlate browser telemetry with cross-origin data access patterns, particularly outbound transfers of session material shortly after media API calls.
- Monitor for exploit chains that combine renderer compromise primitives with media API abuse.
Monitoring Recommendations
- Enable endpoint browser version reporting through management tooling such as Chrome Browser Cloud Management.
- Log and alert on renderer process anomalies including unexpected child processes and crash dumps.
- Review web proxy and DNS logs for connections to newly registered domains hosting media-related JavaScript payloads.
How to Mitigate CVE-2026-17795
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms.
- Force browser restarts through endpoint management to ensure the patched binary is loaded into memory.
- Audit Chromium-derived browsers, such as Edge and Brave, for vendor-issued updates that incorporate the same fix.
Patch Information
Google released the fix in Chrome stable channel version 151.0.7922.72. See the Google Chrome Update Announcement for release notes and the Chromium Issue Tracker Entry for issue metadata.
Workarounds
- Restrict access to the GetUserMedia API through enterprise policy for user populations that do not require camera or microphone functionality.
- Enforce site isolation and disable unnecessary browser extensions to reduce renderer attack surface.
- Apply strict Content Security Policy on sensitive internal web applications to limit the impact of cross-origin leaks.
# Configuration example: Chrome enterprise policy to disable media capture defaults
# Windows registry (HKLM\SOFTWARE\Policies\Google\Chrome)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v AudioCaptureAllowed /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v VideoCaptureAllowed /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
