CVE-2026-17978 Overview
CVE-2026-17978 is a side-channel information leakage vulnerability in the WebCodecs component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can craft an HTML page that leaks potentially sensitive information from process memory when rendered by a vulnerable browser. Chromium rates the security severity as Low. The weakness is classified under CWE-1300, improper protection of physical side channels, applied here to a software-observable channel exposed through the WebCodecs API.
Critical Impact
A remote attacker can retrieve residual data from Chrome's process memory by luring a user to a crafted web page that exercises the WebCodecs API.
Affected Products
- Google Chrome desktop versions prior to 151.0.7922.72
- Chromium-based browsers that embed the affected WebCodecs implementation
- Applications relying on Chromium Embedded Framework (CEF) builds before the corresponding fix
Discovery Timeline
- 2026-07-30 - CVE-2026-17978 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17978
Vulnerability Analysis
The flaw resides in WebCodecs, the browser API that exposes low-level access to audio and video encoders, decoders, and raw frame buffers. WebCodecs handles media data inside privileged renderer components. The implementation exposes a side channel that allows a remote attacker to infer contents of adjacent process memory without directly reading it. The advisory characterizes the impact as information disclosure limited to potentially sensitive data resident in the renderer process. There is no indication of memory corruption, code execution, or sandbox escape tied to this issue. Google classified the Chromium severity as Low, and no exploit or proof-of-concept is currently listed in public repositories.
Root Cause
The root cause is a side-channel leak in WebCodecs mapped to [CWE-1300]. Timing, cache, or state-dependent behavior in the codec path allows an attacker's JavaScript to observe measurable differences that correlate with uninitialized or adjacent memory. The result is partial disclosure of process memory contents rather than direct read primitives.
Attack Vector
Exploitation requires a victim to visit or be redirected to attacker-controlled HTML. The page instantiates WebCodecs objects, submits crafted media inputs, and observes side-channel signals returned by the API. No authentication, elevated privileges, or user interaction beyond page navigation is required. The attack is remote and network-reachable.
No verified proof-of-concept has been published. Refer to the Chromium Issue Tracker Entry once the restriction is lifted for implementation-level detail.
Detection Methods for CVE-2026-17978
Indicators of Compromise
- Browser telemetry showing Chrome versions below 151.0.7922.72 in active use across managed endpoints.
- Outbound HTTP(S) requests from browser processes to low-reputation domains immediately followed by extended WebCodecs API activity.
- Renderer processes with sustained high-frequency VideoDecoder, AudioDecoder, or VideoFrame allocations tied to a single origin.
Detection Strategies
- Inventory installed Chrome and Chromium-derivative versions using endpoint management data and flag builds earlier than 151.0.7922.72.
- Correlate browser process telemetry with DNS and proxy logs to surface repeated visits to newly registered or uncategorized domains that serve heavy WebCodecs content.
- Review browser crash and stability reports for anomalies in renderer processes handling media APIs.
Monitoring Recommendations
- Ingest browser update status and process telemetry into a centralized data lake for version drift detection.
- Alert on endpoints where automatic Chrome updates are disabled or stalled for more than seven days.
- Track web proxy logs for pages that load unusual combinations of scripted media decoding and cross-origin resource fetches.
How to Mitigate CVE-2026-17978
Immediate Actions Required
- Update Google Chrome to 151.0.7922.72 or later on all managed endpoints.
- Verify Chromium-based applications and embedded browsers incorporate the corresponding upstream fix.
- Confirm that automatic browser updates are enabled and not blocked by group policy or network filtering.
Patch Information
Google addressed the issue in Chrome Stable 151.0.7922.72. Details are published in the Google Chrome Update Announcement. Downstream Chromium redistributors should rebase to the patched Chromium revision referenced in the Chromium Issue Tracker Entry.
Workarounds
- Restrict browsing to trusted origins using enterprise policy and URL allow-lists until patches are deployed.
- Disable or restrict WebCodecs usage via site isolation and content policy where feasible for high-risk user populations.
- Enforce strict site isolation and ensure Chrome sandboxing features remain enabled to limit the reach of any renderer-scoped disclosure.
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Expected output: version string >= 151.0.7922.72
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
