CVE-2026-17951: Google Chrome WebRTC Buffer Overflow Flaw

CVE-2026-17951 Overview

CVE-2026-17951 is a heap buffer overflow vulnerability in the WebRTC component of Google Chrome affecting versions prior to 151.0.7922.72. A remote attacker can trigger an out-of-bounds memory read by convincing a user to visit a crafted HTML page. Chromium classifies this issue at Low security severity.

The flaw resides in WebRTC, the real-time communication stack used for audio, video, and peer-to-peer data channels in the browser. Exploitation requires no authentication, only user interaction with attacker-controlled web content. The out-of-bounds read can enable information disclosure from adjacent heap memory. The weakness is tracked under [CWE-122: Heap-based Buffer Overflow].

Critical Impact
Remote attackers can read out-of-bounds heap memory in the renderer process by serving a crafted HTML page to any Chrome user on an unpatched version.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable WebRTC stack
Desktop Chrome stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17951 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17951

Vulnerability Analysis

The vulnerability is a heap buffer overflow in Chrome's WebRTC implementation that manifests as an out-of-bounds memory read. When Chrome processes attacker-controlled WebRTC content delivered through a crafted HTML page, the code reads past the boundary of a heap-allocated buffer. The result is disclosure of memory contents that should not be accessible to the web content.

WebRTC handles complex media negotiation, encoding, decoding, and transport. Bugs in this component historically arise from mismatches between declared buffer sizes and actual data lengths during packet parsing, media frame processing, or session description handling. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for the fix reference.

Root Cause

The root cause is a missing or incorrect bounds check in a WebRTC code path that leads to reading beyond the end of a heap allocation. Google has not published detailed source-level analysis for this issue. The Chromium project restricts issue tracker entries for security bugs until fixes propagate to downstream users.

Attack Vector

An attacker hosts a crafted HTML page that invokes WebRTC APIs with malformed inputs. When a Chrome user on an unpatched build loads the page, the browser triggers the out-of-bounds read inside the WebRTC component. The attacker can potentially exfiltrate leaked memory contents through side channels or by combining the read primitive with other bugs to escalate impact.

The vulnerability requires no privileges beyond serving a web page. It does require user interaction: the victim must navigate to attacker-controlled content or a page under the attacker's influence.

No public proof-of-concept exploit code is available at this time. Refer to the vendor references for technical context.

Detection Methods for CVE-2026-17951

Indicators of Compromise

Chrome renderer process crashes or unexpected terminations correlated with visits to unfamiliar domains hosting WebRTC content
Browser telemetry showing Chrome versions earlier than 151.0.7922.72 in the environment
Outbound WebRTC connections (STUN, TURN, ICE) initiated from user sessions that did not originate a legitimate call

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Monitor browser process crash reports for signatures pointing to WebRTC modules such as libwebrtc frames
Correlate web proxy logs with threat intelligence feeds to identify pages known to abuse WebRTC parsing bugs

Monitoring Recommendations

Enforce automatic Chrome updates through enterprise policy and audit compliance weekly
Alert on Chrome renderer crashes captured by endpoint telemetry to catch exploitation attempts early
Track WebRTC-heavy traffic from user endpoints to unclassified or newly registered domains

How to Mitigate CVE-2026-17951

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Verify that Chromium-based browsers in the environment have absorbed the upstream WebRTC fix
Restart Chrome processes after applying the update so the patched binaries load into memory

Patch Information

Google released the fix in the stable channel update announced in the Google Chrome Update Announcement. The fixed version is 151.0.7922.72 for desktop. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or MDM tooling to accelerate deployment.

Workarounds

Disable WebRTC in browser policy where it is not required for business functions
Restrict browsing to trusted domains through web filtering until the patch is deployed
Isolate high-risk user browsing in a sandboxed or remote browser environment

bash

# Enforce minimum Chrome version via Group Policy (Windows registry example)
# Verify installed Chrome version before and after patching
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version

# macOS: check installed version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux: check installed version
google-chrome --version