CVE-2026-79265 Overview
CVE-2026-79265 is an incomplete cleanup vulnerability [CWE-459] in the GetUserMedia implementation of Google Chrome versions prior to 152.0.7977.65. The flaw allows a remote attacker who has already compromised the renderer process, combined with social engineering, to obtain sensitive information through a crafted HTML page. Google classifies the Chromium security severity as Medium.
Critical Impact
Attackers can exfiltrate sensitive data from a compromised renderer process by exploiting residual media stream state left behind after GetUserMedia operations.
Affected Products
- Google Chrome Desktop versions prior to 152.0.7977.65
- Chromium-based browsers using the affected GetUserMedia code path
- Downstream builds that inherit the pre-patch WebRTC media capture logic
Discovery Timeline
- 2026-08-25 - CVE-2026-79265 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79265
Vulnerability Analysis
The vulnerability resides in Chrome's GetUserMedia API, which negotiates access to microphone and camera devices for WebRTC applications. The implementation fails to fully release or sanitize resources associated with a media capture request after use. Residual state persists in the renderer process memory, where a compromised renderer can read it. Because exploitation requires an already-compromised renderer plus user interaction driven by social engineering, the attack complexity is high.
Root Cause
The root cause is classified as incomplete cleanup [CWE-459]. When a media stream produced by GetUserMedia terminates, associated buffers, handles, or reference structures are not consistently zeroed or freed. This leaves recoverable artifacts inside renderer memory that should have been discarded when the capture ended.
Attack Vector
An attacker must first achieve code execution inside the Chrome renderer sandbox through a separate flaw. The attacker then hosts a crafted HTML page and uses social engineering to convince the target to grant camera or microphone permissions. Once the media session completes, the attacker reads the residual data from the renderer's address space and exfiltrates it to an attacker-controlled endpoint.
No verified public exploit code is available. See Chromium Issue #523661149 for tracking details and the Chrome Desktop Update August 2026 advisory for release notes.
Detection Methods for CVE-2026-79265
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.65 in the environment
- Renderer processes making unexpected outbound network requests shortly after getUserMedia prompts
- Browser telemetry showing repeated camera or microphone permission prompts on unfamiliar domains
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
- Correlate WebRTC permission events with subsequent outbound HTTPS connections to newly observed domains.
- Monitor for renderer process anomalies such as unexpected child processes or memory access patterns consistent with prior renderer compromises.
Monitoring Recommendations
- Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation and version compliance reporting.
- Alert on user reports of unsolicited camera or microphone prompts, which often precede social engineering attempts.
- Track domains newly requesting getUserMedia access and score them against threat intelligence feeds.
How to Mitigate CVE-2026-79265
Immediate Actions Required
- Update all Chrome Desktop installations to version 152.0.7977.65 or later immediately.
- Force-restart browser sessions after deployment to ensure the patched binary is loaded.
- Audit enterprise policy to restrict which sites can request camera and microphone access.
Patch Information
Google addressed the flaw in Chrome 152.0.7977.65 through the stable desktop channel update. Administrators should push the update via managed deployment tools and validate rollout using the Chrome Desktop Update August 2026 release notes.
Workarounds
- Disable getUserMedia access through enterprise policy for users who do not require WebRTC audio or video features.
- Deliver user awareness training focused on rejecting unexpected camera or microphone prompts from unfamiliar sites.
- Enforce site isolation and strict permission prompts through Chrome group policy until patching completes.
# Configuration example: Chrome enterprise policy to restrict media capture defaults
# Windows registry path (HKLM\Software\Policies\Google\Chrome)
# VideoCaptureAllowed = 0
# AudioCaptureAllowed = 0
# VideoCaptureAllowedUrls = ["https://trusted.example.com"]
# AudioCaptureAllowedUrls = ["https://trusted.example.com"]
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
