CVE-2026-78950

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65

Description An integer overflow exists in the WebRTC component. The issue occurs in the RTCRtpSender.setParameters() path, where a WebIDL unsigned long maxBitrate is converted into a signed C++ int, resulting in an unsafe unsigned-to-signed conversion. A remote attacker could potentially execute arbitrary code inside the sandbox by inducing this behavior via a crafted HTML page.

Recommendations Update Google Chrome to version 152.0.7977.65 or later.