Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-79265)

CVE-2026-79265 describes an incomplete cleanup vulnerability in the GetUserMedia API of Google Chrome versions before 152.0.7977.65. An attacker who has already compromised the renderer process can leverage social engineering via a crafted HTML page to extract sensitive information. The vulnerability is classified under CWE-459 (incomplete cleanup). The CVSS 3.1 base score is 5.3, reflecting a network attack vector with high complexity and requiring user interaction, resulting in high confidentiality impact but no integrity or availability impact.

The vulnerability allows a remote attacker with control over the renderer process to obtain sensitive information from the browser by exploiting incomplete cleanup in the GetUserMedia feature. This could lead to unauthorized disclosure of sensitive data. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, users should exercise caution with untrusted content and avoid social engineering attempts that could lead to renderer compromise.