Adventures in Video Conferencing Part 1: The Wild World of WebRTC

Summary: Project Zero's Natalie Silvanovich fuzzed WebRTC, the video conferencing implementation used by Chrome, Safari, Firefox, Facebook Messenger and Signal, and found seven vulnerabilities, including CVE-2018-6156, a large overflow in forward error correction where WebRTC's 1500-byte FEC buffer does no size checking on packets that can reach about 2000 bytes. The bugs included out-of-bounds reads and use-after-frees in the VP8 and VP9 codecs, and the libvpx use-after-free (CVE-2018-6155) prompted a generic fix for software beyond WebRTC; all issues have been fixed.
Why it matters: These bugs sat in RTP processing, which begins the moment a user answers a call, so the exposure was not a malicious file or link but simply picking up. The FEC overflow is the one to sit with: a 1500-byte buffer accepting roughly 2000-byte packets with no size check, in a stack that Chrome, Safari, Firefox, Messenger and Signal all ship.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026