Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76024updated 30 Oct 2026, 01:17 UTC

Google Chrome: memory flaw in MediaStream can be exploited via a crafted web page

A bug in how Chrome handles audio and video streams can let a malicious web page read parts of the browser's protected memory. Updating Chrome closes this hole.

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 6.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGoogle Chrome 156.0.8078.79 (Linux) and 156.0.8078.79/.80 (Windows and Mac) · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pageCrafted HTML containing malicious media content
  2. 2User visits pageChrome loads the page automatically
  3. 3MediaStream bug triggersMemory corruption inside the renderer sandbox
  4. 4Sandbox memory readAttacker reads memory they should not access
  5. ResultSensitive browser memory exposed to attacker

What happened

Memory corruption in the MediaStream component of Google Chrome prior to 156.0.8078.79 lets a remote attacker read memory inside the sandbox via a crafted HTML page.

Why it is dangerous: Visiting a malicious or compromised website could expose data held by the browser process, putting anyone who browses with an unpatched Chrome at risk.

Are you affected?

You are affected if you run Google Chrome on Windows, Mac or Linux with a version earlier than 156.0.8078.79 (Windows/Mac 156.0.8078.79/.80).

Google Chrome Stable and Extended Stable channels prior to 156.0.8078.79 (Windows, Mac, Linux)

What to do

  1. Update Google Chrome to 156.0.8078.79 or later (Windows/Mac 156.0.8078.79/.80).
  2. Restart Chrome after the update so the fix takes effect.
  3. Check chrome://settings/help to confirm the version and that updates are applied.

Timeline

  1. 29 Oct 2026, 21:26 UTC
    Publicly disclosed
  2. 29 Oct 2026, 21:26 UTC
    Reported by Google Chrome · Google Chrome
  3. 29 Oct 2026, 23:07 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 01:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76024
CVSS
6.5 / 10
Disclosed
29 Oct 2026, 21:26 UTC
On Zero Radar
29 Oct 2026, 23:07 UTC (2 h after disclosure)
Last change
30 Oct 2026, 01:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome: memory flaw in MediaStream can be exploited via a crafted web page · Zero Radar