CVE-2026-56974

CVE-2026-56974 is an out-of-bounds write (CWE-787) caused by improper input validation (CWE-20) in AudioRtpPayloadEncoderNode.cpp, part of the WebRTC audio processing pipeline in Google's Chromium codebase. The flaw is triggered when the browser processes malformed audio RTP payload data during a WebRTC media session, such as an in-browser voice or video call, which requires user interaction to initiate. Successful exploitation could allow an attacker to achieve remote code execution with no additional execution privileges needed, earning the vulnerability a high CVSS 3.1 score of 8.8. Any user of Google Chrome or another Chromium-based browser is potentially at risk, since WebRTC is enabled by default. There is currently no listing in the CISA Known Exploited Vulnerabilities catalog and no public proof of concept, so active exploitation is not known.

What to do: Update Chrome and all Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron-based apps that bundle Chromium) to the latest stable release as soon as the fix is distributed, and confirm auto-update policies are enforcing it fleet-wide. For managed estates, verify current browser versions against the fixed build once Google publishes the stable-channel rollout note. Until patched, restricting WebRTC via enterprise policy (or blocking untrusted conferencing sites) reduces the attack surface, since exploitation requires a victim to engage in an interactive WebRTC session.