SUSE-SU-2026:3058-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. - CVE-2026-52720: inval...

The vulnerability affects the implementation of the WebRTC technology in Mozilla Firefox ESR and Thunderbird email client, allowing a hacker to execute arbitrary code.

The vulnerability in the implementation of the WebRTC technology in Mozilla Firefox ESR and the Thunderbird email client is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DEBIAN-CVE-2026-15121

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15121

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15121

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15121

CVE-2026-15121 is a use-after-free in WebRTC within Google Chrome, prior to version 150.0.7871.115. The issue allows a remote attacker to execute arbitrary code inside Chrome’s sandbox when a user visits a crafted HTML page. Public references describe the affected software as Google Chrome WebRTC...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in the checksdpcrypto function due to an inverted boolean condition. An attacker can weaken the binding between DTLS certificates and SDP by intercepting and modifying WebRTC signaling...

Linux Distros Unpatched Vulnerability : CVE-2026-14935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic vulnerability was found in GStreamer's webrtcbin component. The checksdpcrypto function contains an inverted boolean condition that causes it to accept...

Chromium: CVE-2026-14078 Policy bypass in WebRTC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Уязвимость технологии WebRTC браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код

Уязвимость технологии WebRTC браузеров Google Chrome и Microsoft Edge связана с возможностью использования памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с помощью специально созданной HTML-страницы...

Уязвимость технологии WebRTC браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код

Уязвимость технологии WebRTC браузеров Google Chrome и Microsoft Edge связана с возможностью использования памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с помощью специально созданной HTML-страницы...

CVE-2026-14015

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-14078

Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14015

Summary: CVE-2026-14015 describes a race condition in WebRTC within Google Chrome on Windows before version 150.0.7871.47. The bug could allow a remote attacker to leak cross-origin data via a crafted HTML page. What’s affected: Google Chrome on Windows; vulnerable component is the WebRTC impleme...

CVE-2026-14015

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-54291

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A race condition in the WebRTC component on Windows allows a remote attacker to leak cross-origin data by using a specially crafted HTML page. WebRTC Web Real-Time Communication is a...

PT-2026-54353

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in WebRTC allows a remote attacker to perform privilege escalation through the use of a crafted HTML page. Recommendations Update Google Chrom...

Vulnerability of the WebRTC component: The signaling browsers Mozilla Firefox, Firefox ESR, and the email client Thunderbird, which allow attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of the WebRTC component: The signaling browsers Mozilla Firefox, Firefox ESR, and the email client Thunderbird are vulnerable due to dependencies on behaviors that are uncertain for each type of implementation. Exploiting this vulnerability allows a malicious actor to compromise...

Astra Linux – Vulnerability in Chromium

Using “after free” in WebRTC in Google Chrome before version 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Integer overflow in WebRTC in Google Chrome prior to version 147.0.7727.55 allowed a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. Chromium security severity: Low...