CVE-2026-11667: Chrome WebRTC Out-of-Bounds Read Vulnerability – CVSS 7.5 High

Technical summary

CVE-2026-11667 is an out-of-bounds read (CWE-125) in Chrome's WebRTC implementation affecting memory-mapped GPU process regions. The vulnerability manifests when the GPU process parses specially crafted HTML, triggering a read beyond allocated buffer boundaries. This out-of-bounds access can corrupt the heap state, creating conditions for privilege escalation or information disclosure. The attack surface is bounded by the GPU process sandbox, but compromising the GPU process itself is sufficient to trigger exploitation. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network accessibility, high attack complexity due to sandbox constraints and user interaction requirements, and high confidentiality/integrity/availability impact.

Business impact

If exploited, an attacker could read or modify sensitive data within the GPU process memory space—including graphics buffers, cached credentials, or encryption keys—or trigger a denial-of-service crash. For organizations using Chrome on sensitive workstations, this widens the attack surface for data exfiltration when combined with social engineering. The requirement for GPU process compromise means this is not a trivial remote code execution, but it remains a meaningful escalation risk in targeted campaigns.

Affected systems

Google Chrome prior to version 149.0.7827.103 on Windows, macOS, and Linux systems is affected. The vulnerability is present across all major operating system platforms where Chrome runs. Systems using older or unpatched Chrome releases face exposure; enterprise deployments with auto-update enabled are at lower immediate risk, while those with update deferrals remain vulnerable.

Exploitability

Exploitation requires a remote attacker to first compromise the GPU process (a sandboxed component), then serve a crafted HTML page to a user who clicks or visits it. The attack is not trivial—it demands both prior sandbox compromise and user interaction—placing it in the 'targeted' rather than 'opportunistic' category. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no active in-the-wild exploitation has been formally documented at this time.

Remediation

Update Google Chrome to version 149.0.7827.103 or later immediately. Verify patch deployment via Chrome's internal version check (Menu > About Google Chrome). For enterprise environments, use update policies to enforce minimum version requirements and accelerate rollout. Consider disabling GPU acceleration in high-security contexts as a temporary mitigation if immediate patching is not feasible, though this impacts performance.

Patch guidance

Apply Chrome version 149.0.7827.103 or newer. Most users on stable channel with auto-update enabled will receive this patch automatically; verify completion by navigating to chrome://version/. In enterprise environments, use Chrome policy templates (e.g., MinimumChromeVersion) to enforce the patched version. Extended Stable channel users and those on custom build schedules should prioritize this update given its High severity rating. Test in non-production environments first if organizational policy requires it, but do not delay deployment beyond a few days.

Detection guidance

Monitor Chrome version compliance via endpoint management tools or vulnerability scanning. Log GPU process crashes or memory corruption incidents (check Chrome crash reports and OS-level core dumps for patterns). Intrusion detection systems should flag attempts to deliver WebRTC-triggering HTML payloads to Chrome instances. Network telemetry showing anomalous WebRTC behavior or GPU process restarts may indicate attack attempts. Review browser security audit logs and GPU process sandboxing status to detect tampering.

Why prioritize this

This vulnerability merits immediate patching priority despite not being on the KEV list. It combines High CVSS score (7.5), broad platform coverage (Windows/macOS/Linux), and straightforward user interaction trigger (visiting a webpage). While GPU process compromise is a prerequisite, the impact scope is confidentiality, integrity, and availability—making it a credible escalation vector for sophisticated attackers targeting high-value users. The absence from KEV does not negate urgency; it reflects lack of documented public exploitation, not low risk.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects high potential impact (C:H/I:H/A:H) balanced against moderate attack complexity due to sandbox constraints and mandatory user interaction. The network vector (AV:N) elevates risk compared to local-only flaws. In context, this is a significant but not critical vulnerability—patch within days, not weeks, but not an emergency like a zero-day with active exploitation.

Frequently asked questions