CVE-2026-87430: Google Chrome WebRTC Buffer Overflow Flaw

CVE-2026-87430 Overview

CVE-2026-87430 is a heap buffer overflow vulnerability in the WebRTC component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the flaw by serving a crafted HTML page that triggers memory corruption inside the browser's WebRTC pipeline. Successful exploitation allows arbitrary code execution within the Chrome sandbox. The issue is tracked under CWE-122: Heap-based Buffer Overflow and requires user interaction to visit an attacker-controlled page.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome sandbox by luring users to a malicious HTML page that abuses the WebRTC component.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable WebRTC code prior to the fixed version
Applications and embedded frameworks reusing the affected WebRTC module

Discovery Timeline

2026-09-09 - CVE-2026-87430 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-87430

Vulnerability Analysis

The vulnerability resides in the WebRTC (Web Real-Time Communication) subsystem, which handles peer-to-peer audio, video, and data channels directly inside the browser process. A crafted HTML page can drive WebRTC APIs into a state where an internal buffer is undersized relative to attacker-influenced input, producing a heap-based buffer overflow.

Exploitation requires the target user to load an attacker-controlled page, aligning with the user interaction requirement in the CVSS vector. Because WebRTC parses complex, real-time media streams, overflowing an adjacent heap object can be leveraged to corrupt control data and pivot toward code execution inside the sandboxed renderer.

While the Chromium project rates the underlying security severity as Low, the NVD-assigned score reflects the potential for arbitrary code execution inside the sandbox. Sandbox-scoped execution is not equivalent to full host compromise, but it is a standard first stage in modern browser exploit chains that pair a renderer bug with a sandbox escape.

Root Cause

The root cause is improper bounds handling on a heap allocation within WebRTC processing paths. Attacker-controlled parameters in the HTML or JavaScript driving WebRTC influence the size or content written into a heap buffer without adequate validation, producing an out-of-bounds write classified as CWE-122.

Attack Vector

The attack vector is network-based and remote. An attacker hosts a crafted HTML page that invokes the vulnerable WebRTC code path when a victim visits the page in a vulnerable Chrome build. No authentication is required, and only standard user interaction — navigating to the URL — is needed. Delivery mechanisms include phishing links, malicious advertisements, and compromised legitimate sites.

No verified public proof-of-concept, exploit module, or in-the-wild exploitation has been reported. The CISA Known Exploited Vulnerabilities (KEV) catalog does not list CVE-2026-87430. Technical details are tracked in the Chromium Issue Tracker #542449805.

Detection Methods for CVE-2026-87430

Indicators of Compromise

Unexpected renderer process crashes on chrome.exe or Google Chrome Helper (Renderer) shortly after visiting an untrusted site.
Chrome child processes spawning unusual descendants such as command shells, script interpreters, or file-write utilities.
Outbound WebRTC/STUN/TURN traffic to unfamiliar infrastructure correlated with page loads from newly registered domains.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 153.0.8010.36.
Monitor browser telemetry for repeated renderer crashes tied to the WebRTC component, which can indicate exploitation attempts or unstable exploits.
Correlate web proxy logs with endpoint process telemetry to identify users who visited suspicious URLs immediately before anomalous Chrome behavior.

Monitoring Recommendations

Enable and forward Chrome enterprise reporting and crash telemetry to a central logging platform for anomaly analysis.
Alert on Chrome renderer or GPU processes performing unexpected file writes, registry modifications, or network connections outside standard browsing patterns.
Track EPSS movement for CVE-2026-87430 (currently 0.511%, percentile 41.965) to detect emerging exploit interest.

How to Mitigate CVE-2026-87430

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints, prioritizing internet-facing users.
Restart Chrome after the update to ensure the patched WebRTC libraries are loaded into every browser process.
Audit Chromium-based products (Edge, Brave, Opera, Electron apps) for embedded WebRTC versions and apply vendor updates as they ship.

Patch Information

Google addressed CVE-2026-87430 in the Chrome Stable channel at version 153.0.8010.36. Refer to the Google Chrome Update Announcement for release notes and the Chromium Issue Tracker #542449805 for engineering details. Enterprises using Chrome Browser Cloud Management or Group Policy should confirm automatic updates are enabled and not blocked by staged rollouts.

Workarounds

Disable or restrict WebRTC in browsers where the feature is not required, using enterprise policy controls until patched builds are deployed.
Enforce site isolation and strict Safe Browsing settings via Chrome enterprise policies to reduce the exploit surface.
Restrict outbound access to untrusted web content through secure web gateways and DNS filtering while patch rollout is in progress.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 153.0.8010.36 or later

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv