CVE-2026-9120: Google Chrome WebRTC Use-After-Free Flaw

CVE-2026-9120 Overview

CVE-2026-9120 is a use-after-free vulnerability in the WebRTC component of Google Chrome. The flaw affects Chrome versions prior to 148.0.7778.179 and allows a remote attacker to execute arbitrary code via a crafted HTML page. Chromium engineers classified the issue with a security severity of High, and the CWE designation is [CWE-416]. Exploitation requires user interaction, typically convincing a target to load an attacker-controlled web page. Successful exploitation grants the attacker code execution within the Chrome renderer process, which can serve as a foothold for sandbox escape chains targeting the underlying operating system.

Critical Impact

A remote attacker can achieve arbitrary code execution in the Chrome renderer process by luring a user to a crafted page that abuses the WebRTC use-after-free condition.

Affected Products

• Google Chrome desktop builds prior to 148.0.7778.179
• Chromium-based browsers shipping the same WebRTC code path prior to the upstream fix
• Embedded applications using affected Chromium WebRTC components

Discovery Timeline

• 2026-05-20 - CVE-2026-9120 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9120

Vulnerability Analysis

The vulnerability resides in the WebRTC implementation inside Google Chrome. WebRTC handles real-time audio, video, and data channel communications and operates on objects with complex lifetime management. A use-after-free condition occurs when code references a heap object after its memory has been freed. An attacker who triggers this state can manipulate the freed allocation to gain control over object metadata, virtual function pointers, or reference fields used by Chrome.

Exploitation produces memory corruption inside the renderer process. From this primitive, an attacker can pivot to arbitrary code execution within the renderer sandbox. Chained with a sandbox escape, the same primitive supports full remote code execution on the host. The attack vector is network-based and requires user interaction in the form of visiting a crafted page.

Root Cause

The root cause is improper object lifetime tracking in WebRTC [CWE-416]. A WebRTC object is freed while another code path retains a dangling reference. Subsequent access to that reference operates on memory that an attacker can reclaim and shape with controlled data.

Attack Vector

The attacker hosts a malicious HTML page that initiates WebRTC operations such as peer connection setup, media stream negotiation, or data channel manipulation. Specific JavaScript sequences race object teardown against continued use, triggering the dangling reference. No authentication is required, and the renderer process loads the page automatically when the victim navigates to it. Refer to the Google Chrome Stable Update and the Chromium Issue Tracker Entry for the upstream details.

Detection Methods for CVE-2026-9120

Indicators of Compromise

• Chrome renderer process crashes referencing WebRTC modules such as peerconnection, rtc_base, or webrtc:: stack frames
• Outbound connections to unfamiliar STUN, TURN, or signaling endpoints initiated from browser sessions visiting untrusted pages
• Child processes spawned by chrome.exe performing reconnaissance or downloading secondary payloads
• Browser versions reporting below 148.0.7778.179 in endpoint inventory telemetry

Detection Strategies

• Inventory deployed Chrome and Chromium-based browser versions and flag any host running a build below 148.0.7778.179
• Monitor endpoint telemetry for anomalous post-exploitation behavior originating from browser processes, including unexpected file writes, registry edits, and process injection attempts
• Alert on renderer crash dumps that reference WebRTC symbols, which can indicate exploitation attempts or unstable exploits

Monitoring Recommendations

• Correlate web proxy and DNS logs with endpoint browser activity to identify users visiting suspicious domains immediately before crash events
• Track WebRTC signaling traffic patterns to surface unusual peer connection establishment from corporate hosts
• Enable crash report collection from managed Chrome installations and forward to a centralized analytics pipeline

How to Mitigate CVE-2026-9120

Immediate Actions Required

• Update Google Chrome to version 148.0.7778.179 or later on all managed endpoints
• Force-restart Chrome after deployment so the patched binary is actually loaded into memory
• Audit Chromium-based browsers and embedded webviews for the same WebRTC code path and apply vendor updates
• Restrict browsing to untrusted sites for high-risk user groups until patch coverage is verified

Patch Information

Google released the fix in the Chrome Stable channel update referenced in the Google Chrome Stable Update advisory. Install 148.0.7778.179 or any later Stable build. Enterprise administrators should push the update through managed update channels and verify the version reported by chrome://version on a sample of endpoints.

Workarounds

• Disable WebRTC functionality through enterprise policy where business workflows do not require it
• Apply browser isolation or remote browser technologies for users that must access untrusted content before patching is complete
• Block known malicious domains at the web proxy and DNS layer to reduce the chance of users reaching crafted exploitation pages

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Group Policy update path for enterprise-managed Chrome
# Computer Configuration > Administrative Templates > Google > Google Chrome > Google Update