Skip to content
Threat Feed
Subscribe

Tag

Webrtc

5 briefs RSS
high advisory

TinyIce Unauthenticated WebRTC Stream Injection Vulnerability

TinyIce versions 0.8.95 through 2.4.1 are vulnerable to unauthenticated stream injection due to a missing authentication check on the WebRTC ingest endpoint (/webrtc/source-offer), allowing a network attacker to hijack broadcasts by publishing arbitrary audio/video to a target mount, replacing the legitimate source's content; patched in version 2.5.0 (CVE-2026-45327).

tinyice webrtc stream-injection missing-authentication
2r 1t
high advisory

ex_webrtc Missing DTLS Fingerprint Validation Allows MITM

The ex_webrtc library is vulnerable to a man-in-the-middle attack due to missing DTLS peer certificate fingerprint validation in the DTLS client role, potentially allowing interception of media and data channels when chained with insecure signaling or a peer with similar validation gaps; upgrade to versions 0.15.1 or 0.16.1 to mitigate this vulnerability.

ex_webrtc +1 webrtc dtls mitm vulnerability
2r 1t
high advisory

CVE-2026-7928 Use-After-Free Vulnerability in WebRTC

CVE-2026-7928 is a use-after-free vulnerability in the WebRTC component of Chromium, affecting Google Chrome and Microsoft Edge (Chromium-based) and potentially allowing for arbitrary code execution.

Edge +1 use-after-free webrtc chromium cve remote-code-execution
2r 4t 1c
critical advisory

CVE-2026-7339: Heap Buffer Overflow in WebRTC

A heap buffer overflow vulnerability exists in the WebRTC component of Google Chrome and Microsoft Edge (Chromium-based), potentially leading to code execution.

Chrome +1 webrtc heap-overflow code-execution cve-2026-7339
2r 1c
medium advisory

WebRTC Signaling Denial-of-Service Vulnerability (CVE-2026-4704)

CVE-2026-4704 is a denial-of-service vulnerability in the WebRTC Signaling component affecting Firefox, Firefox ESR, and Thunderbird, potentially disrupting service availability.

webrtc denial-of-service firefox thunderbird
2r 1t