CVE-2026-84347: Google Chrome WebRTC Use After Free Flaw

CVE-2026-84347 Overview

CVE-2026-84347 is a use-after-free vulnerability in the WebRTC component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.75. A remote attacker can exploit the issue by tricking a user into visiting a crafted HTML page, leading to arbitrary code execution inside the Chrome sandbox. The vulnerability is tracked under [CWE-416] and requires user interaction to trigger. Google categorized the Chromium security severity as Medium, while the National Vulnerability Database rates it High based on impact and network reachability.

Critical Impact
Successful exploitation allows remote attackers to execute arbitrary code within the renderer sandbox, providing a foothold for further sandbox escape chains.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.75
Chromium-based browsers incorporating the vulnerable WebRTC component
Downstream distributions embedding pre-patch Chromium WebRTC code

Discovery Timeline

2026-09-02 - CVE-2026-84347 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84347

Vulnerability Analysis

The vulnerability resides in Chrome's WebRTC (Web Real-Time Communication) implementation. WebRTC handles peer-to-peer audio, video, and data channel communication directly from web pages. A use-after-free condition occurs when the code references heap memory after it has been freed. Attackers can shape the freed memory region and reuse it to redirect control flow.

Exploitation requires the victim to load an attacker-controlled HTML page. Once triggered, the attacker gains arbitrary code execution inside the renderer process, which runs within Chrome's sandbox. Chaining with a sandbox escape would extend impact to the host operating system.

Root Cause

The root cause is improper object lifetime management within a WebRTC code path [CWE-416]. Specific technical details are tracked in Chromium Issue #501679156. Reference counting or ownership assumptions likely fail during signaling or media stream teardown, leaving a dangling pointer that subsequent operations dereference.

Attack Vector

Delivery relies on a crafted HTML page loaded in a vulnerable Chrome version. The attacker hosts the exploit on a controlled site or delivers it through malvertising, phishing, or a compromised third-party resource. WebRTC APIs execute without special permissions in most contexts, expanding the exposed attack surface. See the Google Chrome Desktop Update for release notes.

No verified public proof-of-concept is currently available for this issue. Refer to the Chromium issue tracker for technical details as Google discloses them.

Detection Methods for CVE-2026-84347

Indicators of Compromise

Chrome renderer process crashes with signatures pointing to WebRTC modules
Unexpected outbound connections initiated by Chrome child processes after visiting untrusted pages
Creation of child processes or file writes from a renderer process, which should not occur under normal sandbox operation

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across the fleet and flag any build older than 152.0.7977.75
Monitor renderer process crash telemetry for repeated faults in WebRTC-related modules such as libwebrtc
Correlate browser process anomalies with recent navigation events to identify potential exploitation attempts

Monitoring Recommendations

Ingest browser telemetry and endpoint process events into a centralized analytics platform for cross-host correlation
Alert on suspicious renderer child process creation, memory injection attempts, or unsigned code loads originating from chrome.exe
Track WebRTC signaling to unfamiliar STUN/TURN servers from enterprise endpoints

How to Mitigate CVE-2026-84347

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
Force-restart Chrome to apply pending updates, since staged updates do not activate until the browser is relaunched
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding patched builds once released

Patch Information

Google released the fix in Chrome Stable channel version 152.0.7977.75. Patch details are documented in the Google Chrome Desktop Update advisory. Enterprises using Chrome Browser Cloud Management or group policy can accelerate deployment through managed update channels.

Workarounds

Disable WebRTC via enterprise policy where business workflows do not require it, using WebRtcAllowLegacyTLSProtocols and related URL-restriction policies
Restrict Chrome extensions and site permissions that expose WebRTC APIs to untrusted origins
Route web traffic through a filtering proxy that blocks known malicious domains until patching completes

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the registry for installed Chrome version
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read version from the application bundle
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString