CVE-2026-11096: Chrome WebRTC Out-of-Bounds Read

Technical summary

CVE-2026-11096 is an out-of-bounds read vulnerability (CWE-125) in the WebRTC implementation within Chrome. The flaw permits remote code execution contexts to read beyond allocated memory boundaries, potentially exposing process memory contents to attackers. The vulnerability is network-reachable, requires minimal attacker complexity, and relies on user interaction via a crafted HTML page. With a CVSS 3.1 score of 6.5 (Medium), it scores high on confidentiality impact but carries no integrity or availability consequences.

Business impact

This vulnerability primarily threatens data confidentiality for Chrome users. Attackers can harvest authentication tokens, session cookies, cached credentials, or other sensitive information resident in memory during an active browsing session. While not leading to system compromise or denial of service, the information disclosure can enable secondary attacks such as account takeover or lateral movement. Organizations with high-value users—executives, developers, security staff—face elevated risk from targeted campaigns exploiting this flaw.

Affected systems

The vulnerability affects Chrome versions prior to 149.0.7827.53 running on Windows, macOS, and Linux systems. WebRTC is a core browser component, so all Chrome installations with WebRTC enabled (the default configuration) are in scope. While the CVE lists additional OS vendors (Apple macOS, Linux kernel, Microsoft Windows), the root cause resides in Chrome itself; remediation requires a Chrome update rather than OS-level patches.

Exploitability

Exploitability is moderate to high in real-world scenarios. The attack requires no authentication, runs at network scope, and only needs a user to open a malicious webpage—a low friction barrier given social engineering and drive-by attacks. However, the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation as of the last update. The barrier to weaponization is likely low for sophisticated attackers familiar with memory layouts and WebRTC internals.

Remediation

Users must update Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically delivers patches within days, but administrators should verify deployment in enterprise environments. No workarounds exist; disabling WebRTC is impractical for most users since it supports legitimate video/audio conferencing features. Patching is the only reliable mitigation.

Patch guidance

Deploy Chrome 149.0.7827.53 or later across all managed systems. Verify the update via Chrome Settings > About Chrome, which triggers an automatic check and displays the current version. For enterprise deployments, use Chrome policies to enforce minimum version requirements (ChromeMinimumVersionRequired policy on Windows/Mac, or equivalent mechanisms on Linux). Test the update in a pilot group before full rollout to catch compatibility issues. Prioritize user-facing roles and high-value targets within 48–72 hours of patch availability.

Detection guidance

Monitor for process crashes or anomalous WebRTC behavior in browser telemetry. Look for suspicious JavaScript payloads delivered via email, chat, or web requests that reference WebRTC APIs or memory-adjacent operations. Network detection is limited since the attack vector is localized to the browser; focus on endpoint telemetry. EDR solutions should flag unusual memory access patterns within the Chrome process or unexpected child process spawning. User reports of unexpected browser slowdowns or memory spikes during WebRTC-heavy activities warrant investigation.

Why prioritize this

While the CVSS score is Medium (6.5), the practical risk warrants swift patching due to the low interaction complexity, network reachability, and potential for information theft at scale. The absence of KEV listing suggests the vulnerability is not yet widely weaponized, presenting a window to patch before mass exploitation. Chrome users handling sensitive data—credentials, financial records, intellectual property—should be prioritized, followed by general user populations.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N), network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction dependency (UI:R). The score appropriately captures that attackers can steal data but cannot modify systems or disrupt service. In context, the low barrier to user interaction and the prevalence of Chrome in enterprise and consumer environments elevate the real-world risk above the numerical score alone.

Frequently asked questions