webrtc security

Google and Microsoft disclosed CVE-2026-7928 on May 6, 2026, as a high-severity use-after-free flaw in Chromium’s WebRTC implementation affecting Google Chrome on Windows before version 148.0.7778.96, where a crafted HTML page could allow remote code execution inside the browser sandbox. The bug...

Google and Microsoft patched CVE-2026-7951 in early May 2026 after Chrome versions before 148.0.7778.96 were found vulnerable to an out-of-bounds write in WebRTC that could let a remote attacker run code inside Chrome’s sandbox through a crafted HTML page. The bug is not the loudest flaw in...

Google and Microsoft disclosed CVE-2026-7339 on April 28, 2026, as a heap-based buffer overflow in Chromium’s WebRTC component affecting Google Chrome before 147.0.7727.138, with exploitation possible through a crafted HTML page that triggers heap corruption after user interaction. The bug is...

On April 28, 2026, Google shipped Chrome 147.0.7727.137/138 for Windows and macOS and 147.0.7727.137 for Linux, fixing CVE-2026-7336, a high-severity use-after-free flaw in WebRTC that could let a remote attacker run code inside Chrome’s sandbox through a crafted HTML page. The uncomfortable...

Google’s latest Chromium security disclosure, CVE-2026-5860, is another reminder that browser bugs rarely stay “just browser bugs” for long. Microsoft’s Security Update Guide records the issue as a use-after-free in WebRTC affecting Google Chrome versions prior to 147.0.7727.55, and the record...