Description
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-09-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Update Chrome
AI Analysis

Impact

The vulnerability is a buffer overflow in the WebRTC component of Google Chrome that can be triggered by a maliciously crafted HTML page. When successfully triggered, it may allow an attacker to overwrite memory and potentially execute arbitrary code inside the sandbox that Chrome uses for rendering web content. The impact is limited to operations that run within the browser sandbox.

Affected Systems

Google Chrome versions before 153.0.8010.36 on Windows, macOS, and Linux are susceptible. Users running these earlier stable releases that have not yet updated to a patched version may be affected. The flaw exists in the WebRTC component and remains present until the vendor delivers a fix.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, yet the EPSS score of less than 1% suggests a low exploitation probability. The issue is not listed in CISA's KEV catalog. The likely attack vector is a malicious web page that a user visits; no public exploits are reported at this time, but the flaw could become a target for attackers who can persuade users to load the crafted page.

Generated by OpenCVE AI on September 9, 2026 at 16:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to the latest stable release available for your platform.
  • If WebRTC is not required for your use case, disable it in Chrome settings or via an organization policy to block WebRTC traffic.
  • Ensure Chrome’s automatic update mechanism is enabled so that future security patches are applied promptly.

Generated by OpenCVE AI on September 9, 2026 at 16:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Wed, 09 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Title WebRTC Buffer Overflow Enables Remote Code Execution in Google Chrome
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 09 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Title WebRTC Buffer Overflow Enables Remote Code Execution in Google Chrome

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-122
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T03:55:21.393Z

Reserved: 2026-09-08T22:22:21.578Z

Link: CVE-2026-87430

cve-icon Vulnrichment

Updated: 2026-09-09T12:44:18.515Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T01:16:59.130

Modified: 2026-09-10T04:18:18.683

Link: CVE-2026-87430

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T09:15:16Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow