CVE-2026-87579 Overview
CVE-2026-87579 is a heap buffer overflow vulnerability in the WebRTC component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is classified under [CWE-122: Heap-based Buffer Overflow] and requires user interaction to trigger. Google addressed the issue in the Chrome Stable channel update released through the Google Chrome Stable Update advisory.
Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox, providing an initial foothold that can be chained with a sandbox escape for full system compromise.
Affected Products
- Google Chrome for Desktop versions prior to 153.0.8010.36
- Chromium-based browsers embedding vulnerable WebRTC builds
- Deployments across Windows, macOS, and Linux running affected Chrome builds
Discovery Timeline
- 2026-09-09 - CVE-2026-87579 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87579
Vulnerability Analysis
The vulnerability resides in Chrome's WebRTC (Web Real-Time Communication) implementation, the subsystem responsible for peer-to-peer audio, video, and data streaming in the browser. A heap-based buffer overflow occurs when WebRTC processes attacker-controlled data from a crafted HTML page. The condition allows memory outside an allocated heap buffer to be written, corrupting adjacent structures.
An attacker who controls the corrupted memory can hijack control flow inside the renderer process. Code execution is confined to the Chrome sandbox, but the flaw provides a reliable primitive for the first stage of a browser exploit chain. Chromium's own severity rating for this issue is Medium; the NVD scoring reflects the network attack surface and high impact to confidentiality, integrity, and availability.
Root Cause
The root cause is improper bounds checking on heap-allocated buffers within the WebRTC media or data channel processing paths. When a malformed stream or signaling payload is parsed, size assumptions fail and a write extends past the allocation boundary. Details are tracked in the Chromium Issue Tracker Entry.
Attack Vector
Exploitation is network-based and requires user interaction: the victim must load a malicious page or a page embedding attacker-controlled WebRTC content. No authentication is required. Because WebRTC negotiates media and data channels automatically after JavaScript API calls, an attacker only needs the victim to visit the crafted page. The primitive yields sandboxed code execution and must be paired with a separate sandbox escape to gain host-level access.
No public proof-of-concept or exploit code is available for CVE-2026-87579 at the time of publication. Refer to the vendor advisory and Chromium issue tracker for technical detail.
Detection Methods for CVE-2026-87579
Indicators of Compromise
- Chrome renderer processes crashing with heap corruption signatures shortly after loading external pages that initiate WebRTC sessions.
- Unexpected outbound WebRTC (STUN, TURN, DTLS-SRTP) traffic from browsing sessions on unknown web origins.
- Child processes spawned by chrome.exe or the renderer that do not match normal browser behavior.
Detection Strategies
- Inventory Chrome versions across the estate and flag any build below 153.0.8010.36 as vulnerable.
- Monitor endpoint telemetry for renderer process crashes correlated with WebRTC API usage.
- Inspect proxy and DNS logs for connections to newly registered domains that establish WebRTC peer connections.
Monitoring Recommendations
- Alert on browser process anomalies such as unexpected memory allocation patterns or code execution outside standard renderer memory regions.
- Track browser update compliance through configuration management tooling to confirm patch rollout.
- Correlate web filtering logs with endpoint alerts to identify users who visited suspicious pages preceding a Chrome crash.
How to Mitigate CVE-2026-87579
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
- Force-restart Chrome after the update so the patched binary is loaded into memory.
- Verify managed Chromium-derived browsers ingest the corresponding WebRTC fix from upstream.
Patch Information
Google released the fix in the Chrome Stable channel. Administrators should deploy the update referenced in the Google Chrome Stable Update advisory. Enterprises using Chrome Browser Cloud Management or group policy should trigger an accelerated update cycle rather than waiting for the default staged rollout.
Workarounds
- Restrict access to untrusted websites using web filtering or DNS-layer controls until patching is complete.
- Disable WebRTC through enterprise policy for user groups that do not require real-time communication features.
- Enable site isolation and enhanced sandboxing policies in Chrome to raise the cost of exploit chaining.
# Enterprise policy example: disable WebRTC peer connection over non-proxied UDP
# Windows Group Policy registry path
HKLM\Software\Policies\Google\Chrome\WebRtcUdpPortRange = ""
HKLM\Software\Policies\Google\Chrome\WebRtcAllowLegacyTLSProtocols = 0
# Force minimum Chrome version via Omaha update policy
HKLM\Software\Policies\Google\Update\TargetVersionPrefix{8A69D345-D564-463C-AFF1-A69D9E530F96} = "153.0.8010.36"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
