CVE-2026-8016
HighSummary
A use after free vulnerability in WebRTC in Google Chrome prior to version 148.0.7778.96 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Risk Assessment
This vulnerability could lead to the execution of malicious code in a sandboxed environment, posing a security risk to browser users.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.
Other vulnerabilities in WebRTC in Google Chrome
See all- CVE-2026-8526High
An out of bounds write in WebRTC in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-7988High
Type Confusion in WebRTC in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-7987High
A use after free vulnerability in WebRTC in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-7928High
A use after free vulnerability in WebRTC in Google Chrome on Windows prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2023-3215High
A use after free vulnerability in WebRTC in Google Chrome prior to version 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-12466High
Heap buffer overflow in WebRTC in Google Chrome on Windows prior to version 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- CVE-2026-12461Medium
An out of bounds read in WebRTC in Google Chrome on Windows prior to version 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2026-12447High
Heap buffer overflow in WebRTC in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2023-4076High
Use after free in WebRTC in Google Chrome prior to version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session.
- CVE-2023-3728High
Use after free in WebRTC in Google Chrome prior to version 115.0.5790.98 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Original NVD description (English source)
Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)