Heap Buffer Overflow in Google Chrome WebRTC

Successful exploitation can corrupt heap memory in the Chrome renderer/browser process handling WebRTC content. In practice, this can enable a remote attacker to achieve code execution in the context of the targeted browser process, potentially resulting in compromise of the victim system depending on sandbox escape or chained exploitation. At minimum, the flaw provides a path to browser compromise through malicious web content and may also cause process instability or crashes due to memory corruption.

Until patching is complete, reduce exposure by restricting use of untrusted websites and links, especially attacker-controlled or compromised sites capable of serving crafted HTML. Where operationally feasible, limit or disable WebRTC functionality in high-risk environments, enforce browser isolation or sandboxing controls, and monitor for signs of exploitation from malicious web sessions. Because exploitation was reported in the wild, mitigation should be treated only as temporary risk reduction pending upgrade.

Upgrade Google Chrome to version 103.0.5060.114 or later, as the vulnerability affects versions prior to 103.0.5060.114. Apply the corresponding Chromium-based browser updates where applicable and ensure enterprise-managed endpoints receive the patched browser build on an expedited basis given in-the-wild exploitation.