CVE-2026-87430 in Chrome
Summary
by MITRE • 09/09/2026
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-7945 represents a critical memory safety issue within the WebRTC implementation of Google Chrome prior to version 153.0.8010.36. This flaw is classified as a buffer overflow, which occurs when a program writes more data to a fixed-length block of memory than it can hold. In the context of modern web browsers like Chrome, such vulnerabilities are particularly dangerous because they reside within complex subsystems that handle real-time communication protocols. The WebRTC framework allows for peer-to-peer audio and video communications directly through the browser without requiring plugins or downloads. When an attacker crafts a malicious HTML page containing specially constructed media streams or signaling data, it can trigger this buffer overflow condition during the processing of these web-based real-time communication features.
From a technical perspective, the root cause lies in improper bounds checking within the WebRTC codebase. The Chromium security team has assigned this issue a severity rating of Low, which typically indicates that while the vulnerability is exploitable, it may require specific conditions or limited attack vectors to achieve arbitrary code execution. However, even low-severity vulnerabilities in browser engines are significant because they bypass many traditional network-based defenses by leveraging legitimate web technologies. The exploitation vector involves a remote attacker hosting a crafted HTML page that, when visited by an unsuspecting user, triggers the memory corruption within the sandboxed environment of the Chrome renderer process.
The operational impact of this vulnerability is severe despite its low severity rating in terms of exploit complexity or likelihood. Successful exploitation allows for arbitrary code execution inside the browser's sandbox. Modern browsers employ a multi-process architecture where each tab runs in a restricted sandbox to limit the damage from potential exploits. However, if an attacker can execute arbitrary code within this sandbox, they may be able to escape it through subsequent privilege escalation techniques or exploit other co-located vulnerabilities. This could lead to full system compromise, allowing the attacker to install malware, steal sensitive data such as cookies and credentials, or use the machine for further attacks in a networked environment.
This vulnerability aligns with CWE-120, which describes buffer copy without checking size limits, a fundamental category of memory safety errors that have plagued software development for decades. In terms of offensive security frameworks, this exploit path corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, as the ultimate goal is often to execute commands on the victim's machine via scripts or binaries launched by the malicious webpage. It also relates to T1204, User Execution, since it relies on the user visiting a crafted page, which falls under social engineering vectors if not mitigated by browser security features like site isolation and sandboxing.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where this memory safety issue has been resolved through improved input validation and bounds checking in the WebRTC module. For organizations managing large fleets of devices, automated patch management systems should be configured to prioritize browser updates due to their high exposure surface area. Additionally, users can reduce risk by disabling unnecessary plugins or scripts that interact with real-time communication APIs if they are not actively using them. Security awareness training is also recommended to help users recognize and avoid visiting suspicious websites that may attempt to exploit such vulnerabilities through crafted media content or signaling messages.