CVE-2026-84348 in Chrome
Summary
by MITRE • 09/02/2026
Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within the MediaCapture subsystem of Google Chrome, specifically affecting versions prior to 152.0.7977.75, represents a significant privacy and data integrity risk stemming from improper handling of media stream resources. This flaw allows for an information leak that can be exploited by remote attackers through the delivery of a maliciously crafted HTML page. The core technical issue lies in how the browser manages memory allocation and deallocation associated with camera and microphone streams during specific state transitions or error conditions. When a webpage attempts to access multimedia input devices, Chrome initializes various internal structures to manage audio and video data flow. In this vulnerable version, certain code paths fail to properly sanitize or clear sensitive context information before releasing resources or transitioning between states. This oversight results in the retention of memory contents that may include pointers, identifiers, or partial data from previous sessions or other tabs, which can then be read by an attacker-controlled script embedded within a malicious webpage.
From a technical perspective, this vulnerability aligns with CWE-200, which categorizes exposures where information is leaked to unauthorized actors without explicit intent. The exploitation vector relies heavily on social engineering and web-based attack techniques, as the victim must interact with or load a crafted HTML page that triggers the specific code path responsible for the leak. This scenario is consistent with ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used in conjunction with browser-side scripting to exfiltrate data. The attacker crafts JavaScript code designed to probe the internal state of the MediaCapture API or manipulate DOM elements related to media streams in a way that forces the browser into an unstable state where sensitive memory contents are exposed via side channels or direct access through debugging interfaces if enabled, though typically this involves reading uninitialized memory or stale references that reveal information about other active sessions or user identity markers.
The operational impact of this vulnerability is primarily centered on privacy violations and potential reconnaissance for further attacks. By leaking sensitive information, an attacker could potentially identify unique browser fingerprints, session tokens associated with media streams, or even metadata related to the user's hardware configuration such as connected camera models or microphone types. While the severity is rated as Medium by Chromium security standards, indicating that exploitation requires specific conditions and may not lead directly to full system compromise, it serves as a critical stepping stone in multi-stage attacks. The leaked information can be used to build detailed profiles of victims for targeted phishing campaigns or to bypass certain privacy-focused browser protections that rely on consistent state management. Furthermore, if the leaked data includes identifiers linked to authenticated sessions, it could facilitate session hijacking attempts when combined with other vulnerabilities like cross-site scripting flaws in victim sites.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is upgrading Google Chrome to version 152.0.7977.75 or later, where the underlying memory management logic for MediaCapture has been corrected to ensure proper sanitization of resources upon deallocation. For organizations unable to update immediately due to compatibility constraints, deploying browser policies that restrict access to media capture APIs can reduce the attack surface. Additionally, enabling strict Content Security Policy headers and disabling unnecessary JavaScript execution on untrusted domains can mitigate the risk of exploitation via crafted HTML pages. Developers should also review their use of WebRTC and MediaStream APIs to ensure they are not relying on deprecated or vulnerable interfaces that expose internal browser states. Regular security audits focusing on memory safety in web engine components remain essential, as similar flaws often persist across different subsystems if rigorous code review practices are not maintained throughout the development lifecycle.