CVE-2026-12447: Heap buffer overflow in WebRTC in Google Chrome prior to 149

Synopsis

A heap buffer overflow in the WebRTC component of Google Chrome prior to version 149.0.7827.155 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only a single user interaction (visiting a malicious page). Successful exploitation gives the attacker code execution within the Chrome sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the user browses to an attacker-controlled or compromised URL.

• AuthenticationNot required

  No account or credential of any kind is required; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The user must navigate to a crafted HTML page, making this a social-engineering vector that requires at least one deliberate or tricked browser action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, enabling full control of the sandboxed process.
• With sandbox escape (not guaranteed by this CVE alone), the attacker reads files and credentials accessible to the browser process.
• The attacker can modify browser state, inject content into open pages, and exfiltrate session tokens or saved credentials held in memory.
• The affected Chrome process can be crashed or rendered unresponsive, disrupting the user's browsing session and any web-based workflows.