CVE-2026-17884: Google Chrome WebRTC RCE Vulnerability

CVE-2026-17884 Overview

CVE-2026-17884 is an object lifecycle vulnerability in the WebRTC component of Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72 and allows a remote attacker to trigger heap corruption through a crafted HTML page. Chromium security engineers rated the issue Medium severity. Successful exploitation requires the victim to visit an attacker-controlled web page, which then abuses object lifecycle mismanagement inside the WebRTC subsystem. Heap corruption in the browser process or renderer can be leveraged for arbitrary code execution or sandbox escapes when combined with additional bugs.

Critical Impact
A remote attacker can trigger heap corruption in Chrome's WebRTC stack through a crafted HTML page, potentially leading to arbitrary code execution in the browser process.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers using the same WebRTC codebase prior to the corresponding patch
Desktop Chrome Stable channel (Windows, macOS, Linux)

Discovery Timeline

2026-07-30 - CVE-2026-17884 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17884

Vulnerability Analysis

The vulnerability resides in WebRTC, the real-time communications framework built into Chrome. WebRTC handles peer-to-peer media streams, data channels, and signaling directly from JavaScript running on any web page. The specific flaw is an object lifecycle issue, which typically manifests as a use-after-free or a double-free condition when an object is released while other code paths still hold references to it.

An attacker who controls a page that the victim loads can script WebRTC APIs to reach the vulnerable code path. Manipulating peer connections, data channels, or media tracks in unexpected sequences can force the browser to operate on a dangling pointer or a partially destroyed object. This results in heap corruption inside the renderer process.

Heap corruption of this class is frequently used as the first stage of a renderer exploit chain. Attackers pair it with a sandbox escape to achieve code execution outside the browser process.

Root Cause

The root cause is improper management of object lifetimes within WebRTC. A referenced object is either freed too early or reused after destruction, breaking the invariants the surrounding code relies on. Consult the Chromium Issue Tracker Entry once Google removes the access restriction for implementation-level details.

Attack Vector

Exploitation is network-based and requires user interaction limited to visiting a malicious or compromised web page. No authentication or privileged access is needed. The attacker delivers JavaScript that instantiates WebRTC objects and drives them through a state sequence designed to trigger the lifecycle bug. See the Google Chrome Update Announcement for the vendor-published fix notice.

Detection Methods for CVE-2026-17884

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures shortly after loading an external page that invokes WebRTC APIs
Browser telemetry showing outbound stun: or turn: connections to attacker-controlled infrastructure from unexpected user contexts
Endpoint alerts on child processes spawned by chrome.exe immediately following a renderer crash

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72
Monitor Chrome crash telemetry for repeated renderer faults tied to WebRTC modules and correlate with recent browsing history
Inspect proxy and DNS logs for anomalous WebRTC signaling traffic to untrusted hosts

Monitoring Recommendations

Enable browser management policies that report version and crash data to a central console
Ingest Chrome crash logs and endpoint process telemetry into the SIEM for correlation with web gateway events
Alert on unexpected process creation from browser processes, which can indicate a successful sandbox escape chain

How to Mitigate CVE-2026-17884

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after updating; the patch does not apply to running instances until relaunch
Apply corresponding updates to other Chromium-based browsers as their vendors ship fixes

Patch Information

Google addressed the issue in Chrome Stable 151.0.7922.72. Details are published in the Google Chrome Update Announcement. Enterprise administrators should push the update through their standard browser management channels and verify deployment coverage.

Workarounds

Enforce automatic Chrome updates through group policy or MDM to reduce exposure windows
Restrict access to untrusted sites via web filtering while the patch is being deployed
Where WebRTC is not required, disable it through enterprise policy to eliminate the attack surface

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy example to enforce automatic updates (Windows)
# HKLM\SOFTWARE\Policies\Google\Update\UpdateDefault = 1 (DWORD)