Description
Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A race condition in the WebRTC component of Google Chrome on Windows allows a malicious web page to trigger a flaw that causes the browser to read and expose data belonging to a different origin. This vulnerability represents a confidentiality breach and is classified as CWE-362.

Affected Systems

Google Chrome users on Windows with a version earlier than 150.0.7871.47 are affected.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, while the EPSS score of < 1% suggests a very low but non-zero exploitation likelihood. The vulnerability is not listed in CISA KEV. Exploitation requires a victim to visit a crafted web page that triggers the WebRTC race condition during normal browser activity, allowing the attacker to read cross-origin data from the browser’s memory. While feasible, the low EPSS indicates limited real-world spread.

Generated by OpenCVE AI on August 2, 2026 at 00:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to at least version 150.0.7871.47, which removes the WebRTC race condition.
  • If an upgrade is not immediately possible, disable WebRTC by setting the chrome flag chrome://flags/#enable-webrtc to Disabled or using an extension that blocks WebRTC traffic.
  • Ensure web applications enforce strict same-origin policies and relevant Content-Security-Policy headers to limit cross-origin data exposure.

Generated by OpenCVE AI on August 2, 2026 at 00:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Sun, 02 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Causes Cross-Origin Data Leakage

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross-Origin Data Leak

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross-Origin Data Leak

Tue, 21 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross‑Origin Data Leakage

Thu, 16 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross‑Origin Data Leakage

Tue, 14 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title WebRTC Race Condition Causes Cross-Origin Data Leakage in Google Chrome Windows

Mon, 13 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title WebRTC Race Condition Causes Cross-Origin Data Leakage in Google Chrome Windows

Sat, 11 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Enables Cross-Origin Data Leakage

Thu, 09 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Enables Cross-Origin Data Leakage

Thu, 09 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross-Origin Data Leakage

Wed, 08 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross-Origin Data Leakage

Tue, 07 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title WebRTC Race Condition Enables Cross‑Origin Data Leakage in Chrome on Windows

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Title WebRTC Race Condition Enables Cross‑Origin Data Leakage in Chrome on Windows

Mon, 06 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross-Origin Data Leak on Windows

Sun, 05 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Allows Cross-Origin Data Leak on Windows

Sat, 04 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Leading to Cross-Origin Data Leakage

Sat, 04 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Leading to Cross-Origin Data Leakage

Fri, 03 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Race Condition in WebRTC Enables Cross‑Origin Data Leakage

Fri, 03 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Race Condition in WebRTC Enables Cross‑Origin Data Leakage

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leakage via WebRTC Race Condition in Google Chrome

Thu, 02 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leakage via WebRTC Race Condition in Google Chrome

Thu, 02 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Enables Cross-Origin Data Leak

Thu, 02 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome WebRTC Enables Cross-Origin Data Leak

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title WebRTC Race Condition Allows Cross-Origin Data Leak in Chrome
Weaknesses CWE-200
CWE-665

Wed, 01 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title WebRTC Race Condition Allows Cross-Origin Data Leak in Chrome
Weaknesses CWE-200
CWE-665

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T14:27:37.120Z

Reserved: 2026-06-29T23:04:18.693Z

Link: CVE-2026-14015

cve-icon Vulnrichment

Updated: 2026-07-01T14:23:31.641Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-30T23:17:14.390

Modified: 2026-07-01T19:39:06.603

Link: CVE-2026-14015

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T00:30:03Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')