CVE-2026-17800: Chrome MediaRecording Info Disclosure

CVE-2026-17800 Overview

CVE-2026-17800 affects Google Chrome versions prior to 151.0.7922.72. The vulnerability stems from an inappropriate implementation in the MediaRecording component. A remote attacker can craft an HTML page to obtain potentially sensitive information from process memory. Chromium security assigned this issue a Medium severity rating.

The weakness is classified under CWE-1300, which covers improper protection of physical side channels. Successful exploitation requires only that a user visits an attacker-controlled page, making this a client-side information disclosure issue in the browser's media capture pipeline.

Critical Impact
Remote attackers can leak sensitive data from Chrome's renderer process memory by luring users to a crafted HTML page that abuses the MediaRecording API.

Affected Products

Google Chrome versions prior to 151.0.7922.72 on desktop platforms
Chromium-based browsers embedding vulnerable MediaRecording code
Downstream distributions repackaging affected Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17800 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17800

Vulnerability Analysis

The vulnerability resides in Chrome's MediaRecording implementation. This API allows web pages to capture audio and video from user devices and process the data through the MediaStream Recording specification. An inappropriate implementation in this component permits data structures to expose uninitialized or adjacent memory contents to JavaScript running in the renderer process.

When a crafted HTML page invokes the affected recording paths, the returned media data or associated buffers can carry residual bytes from process memory. An attacker who scripts repeated recording operations can iteratively harvest fragments and reconstruct sensitive material such as tokens, cross-origin content, or pointers that assist further exploitation.

The issue is categorized under CWE-1300. The advisory does not indicate memory corruption or code execution; the impact is confidentiality of process memory contents accessible through the MediaRecording surface.

Root Cause

The root cause is an implementation defect in how MediaRecording constructs or serializes recorded output. Buffers are exposed to script without a guarantee that all backing memory was fully written by the recording pipeline, allowing residual bytes to leak into web-accessible outputs.

Attack Vector

Exploitation is remote and requires user interaction. The victim must load a crafted HTML page in a vulnerable Chrome build. The attacker's page invokes the MediaRecording API in a sequence designed to trigger the leak and then reads the resulting data via standard web APIs. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2026-17800

Indicators of Compromise

Chrome desktop clients reporting a version string below 151.0.7922.72 in endpoint inventory
Browsing telemetry showing visits to untrusted domains that repeatedly instantiate MediaRecorder objects
Unusual outbound POSTs containing binary blobs shortly after MediaRecording API activity

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any below 151.0.7922.72.
Monitor web proxy and DNS logs for user visits to newly registered or low-reputation domains coinciding with sustained media capture sessions.
Correlate browser process memory growth and repeated renderer allocations with pages using the MediaRecording API.

Monitoring Recommendations

Enforce browser version reporting through management tooling such as Chrome Browser Cloud Management.
Alert on script activity that instantiates MediaRecorder on domains outside an approved allow-list.
Track exfiltration-sized uploads originating from browser processes after media API usage.

How to Mitigate CVE-2026-17800

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop endpoints.
Restart browsers after update to ensure the vulnerable renderer code is unloaded from memory.
Audit Chromium-based applications and embedded frameworks for equivalent patched builds.

Patch Information

Google released the fix in the stable channel update announced in the Google Chrome Update Announcement. Users on 151.0.7922.72 or later are not affected. Enterprise administrators should distribute the patched build through their standard software deployment channel and verify version compliance across the fleet.

Workarounds

Restrict use of the MediaRecording API via enterprise policy or Permissions-Policy headers where feasible.
Deny camera and microphone permissions by default and grant only to trusted origins until patching is complete.
Isolate high-risk browsing activity in a separate profile or remote browser isolation environment.

bash

# Configuration example: enforce minimum Chrome version and restrict media capture defaults via policy
# Linux managed policy: /etc/opt/chrome/policies/managed/cve-2026-17800.json
{
  "AudioCaptureAllowed": false,
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowedUrls": ["https://trusted.example.com"],
  "VideoCaptureAllowedUrls": ["https://trusted.example.com"],
  "TargetChannel": "stable"
}