CVE-2026-7951: Google Chrome WebRTC RCE Vulnerability

CVE-2026-7951 Overview

CVE-2026-7951 is an out-of-bounds write vulnerability [CWE-787] in the WebRTC component of Google Chrome versions prior to 148.0.7778.96. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. The flaw affects Chrome on Windows, macOS, and Linux. Successful exploitation requires the user to load attacker-controlled web content, but no authentication or elevated privileges are needed. Google rated the issue Medium under Chromium severity guidelines, while the National Vulnerability Database (NVD) scored the entry as High due to the impact on confidentiality, integrity, and availability.

Critical Impact

Remote attackers can achieve arbitrary code execution within the Chrome renderer sandbox by tricking a user into visiting a malicious page that abuses the WebRTC stack.

Affected Products

• Google Chrome on Windows prior to 148.0.7778.96
• Google Chrome on macOS prior to 148.0.7778.96
• Google Chrome on Linux prior to 148.0.7778.96

Discovery Timeline

• 2026-05-06 - CVE-2026-7951 published to the National Vulnerability Database
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-7951

Vulnerability Analysis

The vulnerability resides in WebRTC, the real-time communications stack embedded in Chrome that handles audio, video, and data channel transport. WebRTC processes complex media streams, RTP packets, and SDP negotiation directly inside the renderer process. An out-of-bounds write occurs when input parsing or buffer accounting writes data past the boundaries of an allocated memory region. Within Chrome's renderer, this primitive can be leveraged to corrupt adjacent objects, hijack control flow, and execute arbitrary code under the constraints of the renderer sandbox. Sandbox confinement limits direct system impact, but the renderer has access to user session data, cross-origin content reachable through subsequent steps, and additional attack surface against the browser broker process.

Root Cause

The root cause is improper bounds validation during WebRTC data handling, classified as CWE-787 Out-of-bounds Write. The WebRTC code path writes to a memory buffer using attacker-influenced length or index values without confirming the destination falls within the allocation. Chromium addressed the issue in build 148.0.7778.96. See the Chromium Issue Tracker entry for the upstream record.

Attack Vector

Exploitation is network-based and requires user interaction. A target must navigate to a page controlled by the attacker, or load a malicious frame embedded in a third-party site. The page initiates WebRTC operations that drive the vulnerable code path, triggering the out-of-bounds write. No prior authentication to Chrome or the host is required.

No public proof-of-concept code, exploit module, or in-the-wild exploitation has been confirmed for CVE-2026-7951 at the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical analysis is restricted while Chromium issue 496266456 remains under access control, which is standard practice for recently patched browser flaws.

Detection Methods for CVE-2026-7951

Indicators of Compromise

• Renderer process crashes referencing WebRTC modules such as libwebrtc frames in crash signatures on Windows, macOS, or Linux endpoints.
• Outbound connections from chrome.exe or Google Chrome Helper to unfamiliar STUN, TURN, or signaling endpoints immediately preceding renderer instability.
• Browser telemetry showing Chrome versions earlier than 148.0.7778.96 in active use after the patch release.

Detection Strategies

• Inventory installed Chrome versions across the fleet using endpoint management or EDR queries and flag any host below 148.0.7778.96.
• Hunt for child processes spawned by the Chrome renderer that deviate from baseline, such as shell interpreters or scripting hosts launched from a chrome.exe parent.
• Inspect web proxy and DNS logs for newly observed signaling or media relay domains correlated with WebRTC sessions on outdated Chrome builds.

Monitoring Recommendations

• Forward Chrome crash reports and renderer exit codes to the SIEM and alert on repeated WebRTC-related faults across multiple users.
• Track the rollout of Chrome 148.0.7778.96 or later through patch management dashboards and escalate stalled deployments.
• Monitor for anomalous post-exploitation behavior originating from browser processes, including credential store access and unexpected network beacons.

How to Mitigate CVE-2026-7951

Immediate Actions Required

• Update Google Chrome to version 148.0.7778.96 or later on every Windows, macOS, and Linux endpoint.
• Restart Chrome after the update so the patched binaries replace the running renderer and browser processes.
• Apply the same update to Chromium-based browsers and embedded WebViews that pull from the upstream Chromium release once vendors publish their builds.

Patch Information

Google shipped the fix in the Chrome Stable channel build 148.0.7778.96. Refer to the Chrome Stable Update Announcement for the official release notes and the full list of addressed issues. Enterprise administrators using Chrome Browser Cloud Management or MSI/PKG/DEB packages should pull the updated installers from Google's enterprise distribution channels.

Workarounds

• Enforce automatic Chrome updates through the UpdateDefault and AutoUpdateCheckPeriodMinutes enterprise policies until all endpoints are confirmed on the patched build.
• Restrict access to untrusted web content via web filtering or browser isolation while the patch is being deployed.
• Where WebRTC is not required, disable peer-to-peer features using policies such as WebRtcUdpPortRange restrictions or site-specific permission controls to reduce exposure.

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version from the registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: read the version from the application bundle
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString