CVE-2026-79265 in Chrome
Summary
by MITRE • 08/26/2026
Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incomplete cleanup issue within the GetUserMedia API of Google Chrome prior to version 152.0.7977.65 represents a significant breach in process isolation and resource management. This flaw specifically affects the handling of media streams, which are critical for applications requiring access to webcams and microphones. The core technical deficiency lies in the failure to properly release or nullify references to sensitive resources after they have been accessed or when the associated context is terminated. In a secure implementation, any object or stream that grants access to hardware peripherals must be rigorously cleaned up upon closure or error to prevent lingering pointers from being exploited by malicious code running within the same process space.
The operational impact of this vulnerability is severe due to its reliance on a multi-stage attack vector. An attacker cannot exploit this flaw through remote code execution alone; they must first compromise the renderer process, which typically involves exploiting another vulnerability or leveraging social engineering techniques such as phishing to trick a user into visiting a malicious webpage. Once inside the renderer process, the crafted HTML page can trigger the GetUserMedia API and subsequently manipulate the incomplete cleanup state. This allows the attacker to access sensitive information that should have been isolated from the compromised context, effectively bypassing Chrome's security boundaries designed to protect user privacy and data integrity.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective lifetime, or more broadly with CWE-252, unchecked return value, depending on the specific implementation details of how the cleanup was skipped. In terms of offensive security frameworks like MITRE ATT&CK, this behavior facilitates lateral movement within a single browser instance and supports data exfiltration techniques where sensitive media streams are captured without proper authorization checks or session termination protocols. The medium severity rating assigned by Chromium reflects the complexity required to exploit the flaw but acknowledges the high value of the compromised assets, namely real-time audio and video feeds from the user's environment.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where these cleanup routines have been corrected to ensure that all media stream references are properly invalidated upon closure. For organizations managing large fleets of endpoints, enforcing automatic browser updates is critical to closing this window of exposure. Additionally, users should remain vigilant against social engineering attempts and restrict permissions for websites requesting access to cameras and microphones, utilizing Chrome’s built-in permission management tools to limit the attack surface available to potential renderer process compromises.