A hole in the browser's isolation wall lets a crafted page peek at your session's papers
Google Chrome's MediaStream component has a memory corruption flaw that can be triggered by a crafted HTML page. An attacker who convinces a user to visit a malicious site can read arbitrary memory from inside the renderer sandbox, potentially exposing page content, auth tokens, or other session data. Affected versions: Chrome prior to 156.0.8078.79 across Windows, macOS, and Linux.
Chromium labels this Critical, but that internal severity often assumes unattested exploitation chains beyond the described impact. From a patch-management perspective, the observed impact—memory disclosure inside the already-isolated renderer sandbox—is more consistent with a HIGH severity assessment. There is no evidence of sandbox escape, code execution, or integrity/availability impact.
4 steps from start to impact.
User visits an attacker-controlled or compromised page
- Chrome version < 156.0.8078.79
- Victim clicks a link or is redirected to the malicious page
- Chrome auto-updates to the fixed version quickly for most users
- Safe Browsing and URL reputation may block known malicious domains
- User training and awareness reduce link-clicking behavior
Crafted HTML triggers memory corruption in MediaStream
- Attacker has reverse-engineered the vulnerable code path
- Browser has not applied the patch
- Requires precise exploitation—not all malicious pages will succeed
- Chrome's renderer sandbox limits what memory is accessible
- Site isolation may restrict data from other origins
Attacker reads renderer memory via out-of-bounds read
- Exploit successfully triggers the out-of-bounds read
- Sandbox isolation prevents reading host OS memory or other processes
- Site isolation limits cross-site data exposure to the current tab's origin
- No evidence of write primitive or code execution
Data exfiltration via the same page
- Attacker has a server to receive exfiltrated data
- Data volume may be small and hard to distinguish from normal browsing
- Network egress proxies might block suspicious domains, but attacker can use compromised legitimate infrastructure
- Disabling JavaScript globally: Breaks most web apps and is not practical; the exploit is HTML/JS-based, but user productivity cost outweighs benefit.
- Network firewalls/proxies: The attack uses standard HTTPS to deliver the page; blocking outbound traffic is infeasible and won't stop an attacker-controlled page from loading over allowed ports.
- Antivirus signature scans: Memory corruption exploits often don't leave a detectable file signature; relying solely on AV is insufficient.
The supporting signals.
| In-the-wild status | No known exploitation; not KEV-listed. |
|---|---|
| Proof-of-concept availability | No public PoC identified on GitHub or pocindex.io as of 2026-11-01. |
| EPSS | Not available (new CVE); score likely low initially. |
| KEV status | Not listed in CISA KEV catalog. |
| CVSS interpretation | No vendor CVSS vector; assessed impact is remote but limited to sandbox memory disclosure (confidentiality only). |
| Affected versions | Chrome < 156.0.8078.79 (Windows, macOS, Linux). |
| Fixed versions | 156.0.8078.79 and later; check distro backports for Chromium packages. |
| Scanning/exposure | Browsers are ubiquitous; no direct network exposure—attack requires user navigation to malicious page. |
| Disclosure date | 2026-10-30. |
| Researcher | Not disclosed; credited by Chromium security team. |
Sources.
Why this verdict
- Role multiplier: Chrome is a typical endpoint browser. On workstations, impact is limited to renderer sandbox info disclosure. No high-value catalog role (identity, hypervisor, CA, etc.) applies directly, so the floor is not CRITICAL.
- Remote with user interaction: The attack requires the victim to visit a crafted HTML page; automated Chrome updates reduce the vulnerable population quickly.
- Sandbox containment: The official description confines the memory read to the sandbox—no evidence of escape, code execution, or OS-level compromise.
- Vendor label: Chromium calls it Critical, but vendor severity often overstates external exploitability for patch prioritization. Our assessment reflects realistic impact.
Why not higher?
Not CRITICAL because there is no demonstrated sandbox escape, no write primitive, and the impact is informational. The attacker cannot modify data or execute commands outside the browser process. User interaction is required, and a CRITICAL rating is reserved for cases with sandbox escape, browser-process compromise, or fleet-wide impact.
Why not lower?
Not MEDIUM despite the limited impact because it is remotely triggerable, affects a ubiquitous desktop browser, and can expose sensitive session data inside the renderer. A successful exploit could aid further attacks such as credential theft, so it demands patching on a 30-day timeline.
Crowdsourced verification payload.
Run this PowerShell script on each Windows, macOS, or Linux endpoint (admin privileges recommended but not required for read-only checks). Example: powershell -ExecutionPolicy Bypass -File check_chrome_cve_2026_76024.ps1. It compares the installed Chrome version against 156.0.8078.79. Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN.
# check_chrome_cve_2026_76024.ps1
$required = [version]"156.0.8078.79"
$installed = $null
if ($env:OS -eq "Windows_NT") {
$paths = @('HKLM:\SOFTWARE\Google\Chrome\BLBeacon','HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon','HKCU:\SOFTWARE\Google\Chrome\BLBeacon')
foreach ($p in $paths) {
try { $v = (Get-ItemProperty -Path $p -Name version -ErrorAction Stop).version; if ($v) { $installed = [version]$v; break } } catch {}
}
} elseif (Test-Path '/Applications/Google Chrome.app/Contents/Info.plist') {
$plist = Get-Content '/Applications/Google Chrome.app/Contents/Info.plist' -Raw
if ($plist -match '<key>CFBundleShortVersionString</key>\s*<string>([^<]+)</string>') { $installed = [version]$matches[1] }
} elseif ($IsLinux) {
$v = (dpkg-query -W -f='${Version}' google-chrome-stable 2>$null) -replace '-.*$',''
if ($v) { $installed = [version]$v } else {
$v = (rpm -q --qf '%{VERSION}' google-chrome-stable 2>$null)
if ($v) { $installed = [version]$v }
}
}
if ($null -eq $installed) { Write-Output "UNKNOWN"; exit 2 }
if ($installed -lt $required) { Write-Output "VULNERABLE"; exit 0 } else { Write-Output "PATCHED"; exit 1 }