CVE-2026-78950 Overview
CVE-2026-78950 is an integer overflow vulnerability in the WebRTC component of Google Chrome prior to version 152.0.7977.65. A remote attacker can potentially execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-190: Integer Overflow or Wraparound. Exploitation requires user interaction, such as loading an attacker-controlled webpage, but no authentication or elevated privileges. Google has patched the issue in the stable channel update for desktop.
Critical Impact
An attacker can execute arbitrary code inside the Chrome renderer sandbox through WebRTC processing of a malicious HTML page.
Affected Products
- Google Chrome for Windows prior to 152.0.7977.65
- Google Chrome for macOS prior to 152.0.7977.65
- Google Chrome for Linux prior to 152.0.7977.65
Discovery Timeline
- 2026-08-25 - CVE-2026-78950 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78950
Vulnerability Analysis
The vulnerability resides in Chrome's WebRTC (Web Real-Time Communication) implementation. WebRTC handles peer-to-peer audio, video, and data channel communication directly within the browser. An integer overflow occurs when arithmetic operations on untrusted input exceed the maximum value of the underlying integer type. In this case, the overflow leads to incorrect size calculations that can be leveraged for memory corruption. Successful exploitation grants arbitrary code execution inside the renderer sandbox, providing a foothold that attackers typically chain with a sandbox escape to achieve full compromise.
Root Cause
The root cause is improper validation of size or length values inside WebRTC processing logic. When an oversized or attacker-controlled value wraps around, subsequent buffer allocations or indexing operations use an undersized or miscomputed bound. This produces out-of-bounds memory access downstream of the arithmetic error. The Chromium security team labeled the internal severity as Low, but the NVD CVSS 3.1 rating reflects higher network-reachable impact through crafted content.
Attack Vector
Exploitation requires a victim to load a crafted HTML page that invokes WebRTC APIs with malicious parameters. No authentication is required and the attack is delivered over the network. Because WebRTC is enabled by default in Chrome, drive-by-download style delivery through phishing links, malvertising, or compromised sites is viable. The resulting code execution is confined to the renderer sandbox, so a full breakout requires an additional sandbox escape vulnerability.
No public proof-of-concept or exploit code is available at this time. Technical details are tracked in Chromium Issue Tracker #501881082.
Detection Methods for CVE-2026-78950
Indicators of Compromise
- Chrome renderer process crashes or unexpected terminations with WebRTC modules on the call stack.
- Outbound connections to unknown Session Traversal Utilities for NAT (STUN) or Traversal Using Relays around NAT (TURN) servers from user endpoints.
- Chrome processes spawning unusual child processes such as command shells or scripting interpreters.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
- Monitor browser telemetry for anomalous WebRTC session initiations from pages outside expected business domains.
- Correlate renderer crash dumps with visited URLs to identify potential exploitation attempts.
Monitoring Recommendations
- Enable endpoint detection and response telemetry on browser process trees, including parent-child relationships.
- Ingest browser crash and error logs into a centralized data lake for retrospective hunting.
- Alert on Chrome processes writing executables or scripts to disk, a common post-exploitation behavior.
How to Mitigate CVE-2026-78950
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all endpoints and servers.
- Force a browser restart after deployment to ensure the patched binary is loaded.
- Verify Chromium-based enterprise browsers and embedded WebViews are updated on the same schedule.
Patch Information
Google released the fix in the stable channel update for desktop. Details are available in the Google Chrome Stable Update advisory. Enterprise administrators should push the update through Group Policy, Microsoft Intune, Jamf, or the equivalent management platform. Confirm the deployed version reports 152.0.7977.65 or higher via chrome://version.
Workarounds
- Disable WebRTC in managed Chrome deployments via policy where the feature is not required for business functions.
- Restrict outbound User Datagram Protocol (UDP) traffic used by WebRTC at the network perimeter for high-risk user populations.
- Enforce site isolation and strict URL allowlists for users handling sensitive data until patching completes.
# Verify patched Chrome version on Linux endpoints
google-chrome --version
# Expected output (or higher):
# Google Chrome 152.0.7977.65
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
