CVE-2026-12466: Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149

Synopsis

A heap buffer overflow in the WebRTC component of Google Chrome on Windows allows a remote attacker to execute arbitrary code by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit an attacker-controlled page. Successful exploitation gives the attacker full code execution in the context of the Chrome renderer process, enabling data theft, tampering, or further system compromise. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach an attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker only needs the victim to visit a URL.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering (phishing link, malicious ad, etc.) a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental factors.

Blast Radius

• Reads sensitive data accessible to the Chrome renderer process, including session tokens, cookies, and page content from the active browsing context.
• Modifies in-memory state within the renderer, enabling injection of malicious content or exfiltration of autofill or stored credential data surfaced to the page.
• Crashes the affected Chrome tab or renderer process, disrupting the user's session.
• Serves as a foothold for sandbox-escape chains; if combined with a separate privilege-escalation bug, grants full OS-level code execution on the Windows host.