Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 148.0.7778.96
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-7951 Concept
This demonstrates the WebRTC initialization context.
Actual exploitation requires specific heap grooming.
-->
<!DOCTYPE html>
<html>
<body>
<script>
// Initialize RTCPeerConnection to trigger WebRTC module
const pc = new RTCPeerConnection({
iceServers: [{ urls: 'stun:stun.l.google.com:19302' }]
});
// Create a data channel to stimulate code paths vulnerable to OOB write
const dc = pc.createDataChannel("exploit_trigger");
pc.createOffer().then(offer => {
console.log("WebRTC Offer Created");
// Malformed SDP manipulation would occur here to trigger the vulnerability
}).catch(e => console.error(e));
</script>
</body>
</html>