CVE-2026-9959: Chrome WebRTC Race Condition Leaks Cross-Origin Data on Windows

Technical summary

CVE-2026-9959 is a race condition (CWE-362) in Chrome's WebRTC implementation on Windows platforms. The flaw exists in versions prior to 148.0.7778.216 and permits a remote attacker to bypass same-origin policy protections and read cross-origin data through carefully timed interactions with WebRTC session establishment or communication channels. The race window is narrow and non-deterministic, making reliable exploitation difficult. The vulnerability does not afford code execution or denial of service; its impact is confined to confidentiality of data that should remain isolated between origins.

Business impact

Organizations with Windows-based users accessing web applications leveraging WebRTC (video conferencing, real-time communication, collaborative tools) face a risk of sensitive session data exposure. An attacker could craft a malicious webpage to trick users into opening it, potentially exfiltrating data such as authentication tokens, user identifiers, or communication metadata from concurrent cross-origin sessions. The practical risk is lower than the underlying technical severity suggests, given the exploitation barriers. However, any cross-origin data leak affecting authentication or personal information warrants prompt remediation to prevent reputational damage and compliance issues.

Affected systems

Directly affected: Google Chrome on Windows, all versions prior to 148.0.7778.216. Indirectly affected: Any Windows user relying on Chrome for web applications that use WebRTC. Microsoft Windows is listed as a vendor/product but is not inherently vulnerable; it is the host OS. No other Chromium-based browsers (Edge, Brave, Opera, etc.) are mentioned in the CVE description, though they may warrant review if they incorporate affected WebRTC code from upstream Chromium.

Exploitability

Exploitation requires a remote attacker to craft and host a malicious HTML page, then socially engineer or trick a user into opening it while the victim has a cross-origin WebRTC session or related tab active. The attack requires precise timing to win a race condition, which reduces reliability. No public exploit code is known to be in active circulation; the vulnerability is not tracked in CISA's KEV catalog. Automated vulnerability scanning and endpoint telemetry are unlikely to detect exploitation attempts without WebRTC-aware monitoring. An attacker with the ability to inject JavaScript into a webpage (e.g., via XSS or compromise of a third-party script) could attempt exploitation without user awareness.

Remediation

Update Google Chrome to version 148.0.7778.216 or later on all Windows systems. Chrome's auto-update mechanism should deploy this patch within days; verify deployment status in your environment. Organizations using Chrome Fleet Management or other centralized deployment should prioritize this update to mitigate cross-origin data leaks. Users can manually check for updates via Chrome Settings > About Google Chrome. No compensating controls exist for WebRTC race conditions; patching is the only remediation.

Patch guidance

Google has released Chrome 148.0.7778.216 to address this vulnerability. Deploy this update across Windows endpoints with high priority, especially systems used by employees accessing web-based communication platforms, customer-facing applications, or internal collaborative tools. Verify rollout through Chrome's built-in update checks and admin reporting tools. If your organization uses Chrome for education, healthcare, finance, or any domain handling sensitive data, prioritize this patch in your vulnerability management workflow. Stagger rollout if needed to detect compatibility issues, but complete deployment within 2–4 weeks.

Detection guidance

Monitor for Chrome version compliance using endpoint management tools (Intune, Workspace ONE, osquery, etc.). Audit which Windows systems are running Chrome versions before 148.0.7778.216. Enable WebRTC logging and packet inspection on network monitors if your organization runs traffic analysis for high-security environments—look for anomalous WebRTC signaling or STUN/TURN communications. Endpoint Detection and Response (EDR) solutions may flag cross-origin data access patterns if they understand WebRTC semantics, but most will not. Prioritize patching over detection, as the vulnerability is difficult to identify post-compromise without application-level logging.

Why prioritize this

Although the CVSS score is low (3.1), this vulnerability warrants timely patching because it enables silent cross-origin data theft in a ubiquitous browser, affects a high-value attack surface (WebRTC communications), and likely impacts many Windows environments. The practical exploitation barriers (race condition, user interaction, timing) prevent it from reaching critical priority, but the confidentiality impact and Chromium's High severity rating justify treating it as a medium-priority remediation over other low-CVSS issues. Organizations handling sensitive user data or using Chrome for regulated workflows should patch within 2–4 weeks; general enterprise environments can follow standard patch cadences.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects: (1) remote network attack vector (AV:N) with no privilege requirement (PR:N), (2) high attack complexity (AC:H) due to the race condition and timing sensitivity, (3) requirement for user interaction (UI:R), (4) no impact on integrity or availability (I:N, A:N), and (5) confidentiality impact confined to a single security context (S:U, C:L). While Chromium flagged the underlying issue as High severity due to cross-origin data leaks, the CVSS model correctly downrates the practical risk because reliable exploitation is difficult and impact is scoped to information disclosure. The gap between Chromium severity and CVSS reflects the difference between theoretical vulnerability and practical exploitability.

Frequently asked questions