Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Unrated

Out-of-bounds read in WebRTC in Google Chrome on Windows

IdentifiersCVE-2026-12461CWE-125

CVE-2026-12461 is a high-severity out-of-bounds read vulnerability in the WebRTC component of Google Chrome on Windows prior to version 149.0.7827.155. According to the provided content, a remote attacker can trigger the flaw via a crafted HTML page, causing WebRTC to read memory outside the intended bounds. This can result in disclosure of potentially sensitive information from the browser process memory. The issue is described as affecting Chromium as well, and therefore also impacts Chromium-based browsers such as Microsoft Edge through the upstream dependency until patched.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to obtain potentially sensitive information from process memory. The primary impact is information disclosure from the affected browser process. Based on the broader advisory context, such disclosure may expose data useful for further exploitation or exploit chaining, but the specific confirmed impact for this CVE is sensitive memory disclosure rather than code execution.

Mitigation

If you can’t patch tonight, do this now.

No specific workaround is provided in the supplied advisories beyond updating. As interim risk reduction, limit exposure to untrusted web content, apply browser isolation or equivalent enterprise controls where available, and monitor for outdated Chrome/Chromium/Edge versions until patch deployment is complete.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome on Windows to version 149.0.7827.155 or later. For Chromium on Debian, upgrade to the fixed package versions identified in the advisory: 149.0.7827.155-1~deb13u1 for Debian stable (trixie) or 149.0.7827.155-1~deb12u1 for Debian oldstable (bookworm). For Microsoft Edge (Chromium-based), upgrade to version 149.0.4022.80 or later, which incorporates the Chromium fix.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
GoogleChromeapplication
Microsoft CorporationEdgeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.