CVE-2026-12461: Chrome WebRTC Out-of-Bounds Read on Windows

Technical summary

CVE-2026-12461 is an out-of-bounds read vulnerability in Chrome's WebRTC implementation on Windows. The flaw resides in memory access control within WebRTC processing, classified under CWE-125 (out-of-bounds read). When a victim navigates to an attacker-controlled webpage, malformed input triggers an out-of-bounds memory read that can leak data from Chrome's process address space. The vulnerability is network-accessible and requires minimal attacker complexity, though user interaction is mandatory. Chromium security engineers assigned this a High severity rating internally, reflecting the potential for information disclosure from sensitive process regions.

Business impact

Organizations with Windows-based Chrome users face elevated risk of data exfiltration. Attackers could harvest credentials, session tokens, cached authentication data, or other sensitive information resident in process memory. This is particularly concerning for enterprises where employees use Chrome for cloud application access or where Chrome processes contain authentication material. The requirement for user interaction—clicking a link or visiting a site—makes this a social engineering vector. Patching delays increase exposure window for targeted attacks against high-value employees or customers.

Affected systems

Google Chrome on Microsoft Windows prior to version 149.0.7827.155 is vulnerable. Chrome on other operating systems (macOS, Linux, Android) may have separate WebRTC implementations and should be evaluated against their own security advisories. Users on Windows 10, Windows 11, and earlier Windows versions are in scope if they run unpatched Chrome. Chromebook users and Chrome OS deployments are not affected.

Exploitability

Exploitation requires delivering a crafted HTML page to a victim and obtaining user interaction—the user must navigate to or view the malicious content. There is no known public exploit code at this time, and the vulnerability is not tracked on CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and network vector make this suitable for targeted phishing campaigns. Defenders should assume sophisticated threat actors have developed proof-of-concept exploits even if not yet widely published.

Remediation

Update Google Chrome to version 149.0.7827.155 or later on all Windows systems. Check Settings > About > Google Chrome to trigger automatic updates, or manually visit chrome://settings/help. Organizations should enforce Chrome auto-updates via Group Policy (for enterprise deployments) or MDM/mobile device management solutions. Verify that users are no longer on versions prior to 149.0.7827.155 within 30 days. No workarounds short of patching or disabling WebRTC are available.

Patch guidance

Chrome auto-updates are typically deployed within 24–48 hours of release on Windows. Enterprise administrators should verify patch deployment through Chrome Enterprise audit logs or endpoint management dashboards. If auto-update is disabled, manually trigger updates on all devices. Test the update in a non-critical environment first if your organization has strict change control policies. Rollback is not recommended once the patch is applied, as the security issue persists in older versions. Document the patching date for compliance records.

Detection guidance

Monitor Chrome process memory or network traffic for anomalous WebRTC behavior—unusual outbound connections or data exfiltration during WebRTC sessions. Endpoint Detection and Response (EDR) tools should flag out-of-bounds memory access attempts or Chrome process crashes related to WebRTC components. Web proxy logs may capture requests to known malicious HTML pages hosting this exploit. Browser isolation or sandboxing technologies can prevent successful exploitation even if a user visits a malicious site. Security teams should correlate suspicious Chrome process behavior with user browsing history to identify potential exposure.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the Chromium security team rated this High severity due to the practical ease of exploitation and information disclosure impact. Organizations should prioritize this update within the next 30 days, particularly those with high-value users or sensitive data workflows in Chrome. The user-interaction requirement lowers risk compared to wormable vulnerabilities, but targeted phishing campaigns can overcome this barrier. Early patching reduces the window for targeted attacks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: network accessibility (AV:N) with low attack complexity (AC:L), no privilege requirements (PR:N), and user interaction needed (UI:R). The impact is limited to confidentiality (C:H) with no integrity or availability impact (I:N/A:N). The score aligns with information-disclosure flaws but undershoots Chromium's internal High rating because CVSS does not weight likelihood of exploitation or the sensitivity of data in modern browser processes. Security teams should treat this as higher-risk than the CVSS score alone suggests, given Chrome's ubiquity and the nature of cached authentication data.

Frequently asked questions