CVE-2026-84348: Google Chrome MediaCapture Info Leak

CVE-2026-84348 Overview

CVE-2026-84348 is an information disclosure vulnerability in the MediaCapture component of Google Chrome. Versions of Chrome prior to 152.0.7977.75 allow a remote attacker to leak sensitive information through a crafted HTML page. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Google rates the Chromium security severity as Medium. Successful exploitation requires user interaction, such as visiting an attacker-controlled web page.

Critical Impact
A remote attacker can exfiltrate sensitive browser or media-related data from a targeted user after that user loads a malicious HTML page.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.75
Chromium-based browsers incorporating the vulnerable MediaCapture code paths
Any downstream distribution shipping Chromium builds earlier than 152.0.7977.75

Discovery Timeline

2026-09-02 - CVE-2026-84348 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in the NVD database
2026-09 - Google publishes the fix in the Chrome Stable Channel Update for Desktop

Technical Details for CVE-2026-84348

Vulnerability Analysis

The vulnerability resides in Chrome's MediaCapture implementation, which handles camera, microphone, and screen capture APIs exposed to web content. An unauthorized information exposure condition allows a crafted page to obtain data the browser should not release across security boundaries. The confidentiality impact is high, while integrity and availability are not affected. Because the attack vector is network-based and requires only a user visiting a page, drive-by exploitation via malicious or compromised websites is realistic. No privileges are required on the target system.

Root Cause

The issue is tracked in the Chromium Issue Tracker and mapped to [CWE-200]. Google has not disclosed low-level implementation details while users patch. Information leakage in MediaCapture typically stems from missing origin checks, improper state handling between capture sessions, or leakage of device metadata across origins. The fix in 152.0.7977.75 corrects the disclosure path.

Attack Vector

An attacker hosts a crafted HTML page and lures a user to open it. The page invokes MediaCapture-related APIs in a way that triggers unintended data exposure. No authentication or elevated privileges are required. The scope is unchanged, and no memory corruption or code execution occurs. See the Chrome Stable Channel Update for release notes.

No public proof-of-concept code is available. Technical implementation details are not disclosed in the referenced sources, and no synthetic exploit is provided here.

Detection Methods for CVE-2026-84348

Indicators of Compromise

Chrome browser processes at versions earlier than 152.0.7977.75 connecting to untrusted external hosts
Web sessions requesting getUserMedia, getDisplayMedia, or related MediaCapture APIs from low-reputation domains
Outbound HTTP/HTTPS transfers immediately following media capture prompts, especially to domains unrelated to the page origin

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 152.0.7977.75
Correlate browser telemetry with proxy or DNS logs to identify visits to attacker-controlled pages abusing media APIs
Alert on abnormal use of MediaCapture permissions from newly registered or uncategorized domains

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation of Chrome version, URL history, and network egress
Track EPSS movement for CVE-2026-84348 (current EPSS 0.182%) and re-prioritize if the score rises
Monitor enterprise browser management consoles for policy compliance on auto-update and version enforcement

How to Mitigate CVE-2026-84348

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all managed endpoints
Force browser relaunch to ensure users apply the patched binary
Audit Chromium-based products (Edge, Brave, Opera, Vivaldi) for downstream fixes referencing this CVE

Patch Information

Google addressed CVE-2026-84348 in Chrome Stable 152.0.7977.75. Refer to the Chrome Stable Channel Update for Desktop for release notes and the Chromium Issue Tracker Entry for issue metadata.

Workarounds

Restrict access to untrusted websites through enterprise web filtering until patching completes
Disable camera, microphone, and screen capture permissions by default via Chrome enterprise policies (VideoCaptureAllowed, AudioCaptureAllowed, ScreenCaptureAllowed)
Educate users to reject media capture prompts from unknown sites

bash

# Chrome enterprise policy example (Linux managed policy JSON)
# /etc/opt/chrome/policies/managed/mediacapture.json
{
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false,
  "ScreenCaptureAllowed": false,
  "TargetBlankImpliesNoOpener": true,
  "DefaultNotificationsSetting": 2
}