CVE-2026-79027: Google Chrome WebRTC Use After Free Vulnerability

CVE-2026-79027 Overview

CVE-2026-79027 is a use-after-free vulnerability in the WebRTC component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can send crafted network traffic to trigger memory corruption and execute arbitrary code inside the Chrome sandbox. The flaw is tracked under CWE-416: Use After Free and carries a Chromium security severity of High. Google addressed the issue in the Stable channel desktop update.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome sandbox by delivering crafted WebRTC network traffic to a targeted browser.

Affected Products

Google Chrome (Desktop) versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable WebRTC implementation
Applications using affected Chromium builds via CEF or Electron

Discovery Timeline

2026-08-25 - CVE-2026-79027 published to the National Vulnerability Database
2026-08-27 - Last updated in the NVD database
2026-08 - Google releases fix in the Chrome Stable Channel Update for Desktop

Technical Details for CVE-2026-79027

Vulnerability Analysis

The vulnerability resides in Chrome's WebRTC (Web Real-Time Communication) implementation, which handles peer-to-peer audio, video, and data channels directly in the browser. A use-after-free condition [CWE-416] occurs when the code accesses heap memory after it has been released. Attackers who control the timing and content of WebRTC traffic can reclaim the freed allocation with attacker-influenced data. Successful exploitation results in arbitrary code execution within the sandboxed renderer process. The Chromium sandbox constrains the immediate impact, but attackers often chain such flaws with sandbox escapes to reach the host operating system.

Root Cause

The defect stems from improper object lifetime management inside the WebRTC stack. A referenced object is freed while another code path still holds and dereferences a pointer to it. Concurrent processing of signaling and media frames increases the likelihood of dangling references during session teardown or renegotiation.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond loading attacker-controlled content that initiates a WebRTC session. The attacker delivers crafted network traffic across a peer connection to reach the vulnerable code path. Attack complexity is rated High, reflecting timing and heap-grooming requirements needed for reliable exploitation.

No public proof-of-concept exploit code has been verified. Technical specifics remain restricted in the Chromium Issue Tracker #537233963 pending broader user patch adoption.

Detection Methods for CVE-2026-79027

Indicators of Compromise

Unexpected Chrome renderer process crashes with heap corruption signatures in crash telemetry
Chrome processes spawning shell interpreters, script hosts, or unusual child processes following WebRTC session activity
Outbound STUN, TURN, or DTLS traffic to untrusted peers immediately preceding renderer instability

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any version below 152.0.7977.65
Correlate browser crash dumps referencing WebRTC modules (peerconnection, rtc_base) with network telemetry from the same host
Alert on anomalous WebRTC signaling to domains outside sanctioned collaboration platforms

Monitoring Recommendations

Ingest browser version telemetry and crash reports into your SIEM for continuous drift detection
Monitor endpoint process trees for suspicious children of chrome.exe or chrome binaries
Track EPSS movement for CVE-2026-79027 (currently 0.598%) to detect increased exploitation likelihood

How to Mitigate CVE-2026-79027

Immediate Actions Required

Update all Google Chrome desktop installations to version 152.0.7977.65 or later
Restart browsers after patch deployment to ensure the vulnerable code is unloaded from memory
Push updated builds for Chromium-based applications (Electron, CEF) once upstream releases incorporate the WebRTC fix

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Channel Update for Desktop advisory for release notes and version details. Enterprise administrators should deploy via Chrome Browser Cloud Management, Group Policy, or their standard software distribution tooling.

Workarounds

Restrict WebRTC usage through enterprise policy where business workflows permit
Block untrusted peer-to-peer signaling endpoints at the network egress layer
Enforce site isolation and sandboxing policies to limit renderer process capabilities

bash

# Example: Enforce Chrome auto-update and disable WebRTC to non-proxied peers via policy (Linux)
# /etc/opt/chrome/policies/managed/webrtc_policy.json
{
  "WebRtcUdpPortRange": "10000-11000",
  "WebRtcAllowLegacyTLSProtocols": false,
  "WebRtcIPHandling": "default_public_interface_only",
  "ComponentUpdatesEnabled": true
}