CVE-2026-87630: Google Chrome WebRTC Information Disclosure

CVE-2026-87630 Overview

CVE-2026-87630 is an integer overflow vulnerability [CWE-190] in the WebRTC component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and allows a remote attacker to read memory inside the browser sandbox via a crafted HTML page. Exploitation requires user interaction, such as visiting a malicious website. Google assigned this issue a Medium severity rating in the Chromium security bug tracker.

Critical Impact
A remote attacker can trigger an integer overflow in WebRTC to read sandbox memory, potentially exposing sensitive in-process data to a crafted web page.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers that embed the vulnerable WebRTC component
Desktop Stable channel builds on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87630 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87630

Vulnerability Analysis

The vulnerability resides in Chrome's WebRTC (Web Real-Time Communication) implementation. WebRTC handles peer-to-peer audio, video, and data channels directly inside the renderer process. An integer overflow occurs when arithmetic on attacker-influenced size or length values wraps around the maximum representable value.

The wrapped value is then used in downstream memory operations, causing the browser to read past intended buffer boundaries. Because the attacker controls the input through a crafted HTML page, the read primitive can be triggered remotely. The disclosure is bounded to memory contents accessible inside the renderer sandbox, but that memory can still contain data from active WebRTC sessions or other sensitive renderer state.

Root Cause

The root cause is improper validation of numeric inputs used in size or offset calculations within WebRTC processing routines. When these values overflow, the resulting undersized allocation or misaligned index leads to out-of-bounds memory reads. The underlying weakness is classified as CWE-190: Integer Overflow or Wraparound.

Attack Vector

An attacker hosts a malicious HTML page that establishes WebRTC connections or feeds crafted media parameters to the browser. When a user visits the page, the crafted payload triggers the overflow in WebRTC internals. The attacker then leverages the resulting read primitive to leak memory from the renderer process. No authentication is required, but the victim must interact with the malicious content. See the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-87630

Indicators of Compromise

Browser instances still reporting Chrome versions below 153.0.8010.36 after the vendor patch release
Unexpected WebRTC session establishment to untrusted or newly registered domains
Renderer process crashes or memory anomalies correlated with browsing sessions containing embedded WebRTC content

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds older than 153.0.8010.36
Correlate web proxy logs with domains hosting suspicious HTML containing WebRTC signaling to unusual STUN or TURN endpoints
Monitor endpoint telemetry for renderer process anomalies such as repeated crashes tied to webrtc modules

Monitoring Recommendations

Track Chrome update compliance through configuration management or MDM reporting
Alert on outbound WebRTC signaling traffic from user endpoints to non-corporate STUN/TURN infrastructure
Review browser telemetry for crash signatures referencing WebRTC memory subsystems

How to Mitigate CVE-2026-87630

Immediate Actions Required

Update Google Chrome on all endpoints to version 153.0.8010.36 or later
Force a browser restart after patch deployment to ensure the vulnerable renderer code is unloaded
Audit Chromium-based third-party browsers and Electron applications for embedded WebRTC versions that require updates

Patch Information

Google addressed CVE-2026-87630 in the Stable channel release documented in the Chrome Releases Update Announcement. The fix is included in Chrome 153.0.8010.36 and later builds. Enterprise administrators should validate deployment through Chrome Browser Cloud Management or equivalent update tooling.

Workarounds

Disable WebRTC through enterprise policy where real-time communication is not required for business use
Restrict browsing to trusted domains using web filtering to reduce exposure to crafted HTML pages
Enforce site isolation and sandbox hardening policies until patching completes across the fleet

bash

# Enterprise policy example: restrict WebRTC UDP ports via Chrome policy
# Windows registry path for managed Chrome deployments
HKLM\Software\Policies\Google\Chrome\WebRtcUdpPortRange = "10000-11999"

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version