What is the CVSS score of CVE-2026-7898?

CVE-2026-7898 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7898?

Google Chrome's Chromoting remote desktop component contains a critical remote code execution vulnerability (CVE-2026-7898) affecting Linux systems, allowing unauthenticated attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-7898?

Within 24 hours: Identify and inventory all Chrome installations on Linux systems, particularly those with Chromoting enabled or accessed via remote desktop workflows. Within 7 days: Deploy Chrome version 148.0.7778.96 or later across all affected Linux endpoints using your standard patch management process; prioritize systems in sensitive roles or network positions. Within 30 days: Conduct security audit of remote desktop session logs to identify any suspicious activity, and review Chromoting feature enablement policies to restrict access to authorized users only.

Google Chrome CVE-2026-7898

EUVD-2026-27899 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 00:30 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome's Chromoting component (remote desktop feature) on Linux allows unauthenticated attackers to execute arbitrary code through specially crafted network packets when a user interacts with a malicious remote desktop session. Fixed in Chrome 148.0.7778.96. Vendor rates severity as Critical. No public exploit code identified at time of analysis, but the use-after-free class (CWE-416) is well-understood and exploitable. CVSS 8.8 reflects network attack vector with low complexity requiring only user interaction, enabling full system compromise (high confidentiality, integrity, and availability impact).

Technical ContextAI

Chromoting is Google Chrome's built-in remote desktop protocol implementation, allowing users to remotely access computers via Chrome Remote Desktop. This vulnerability is a use-after-free (CWE-416) memory corruption flaw, occurring when the program continues to use a memory pointer after the referenced memory has been deallocated. In Chromoting's network traffic handling code, malicious packets can trigger this condition, causing the application to access freed memory. Attackers can manipulate the freed memory region to redirect program execution flow. The flaw is specific to the Linux implementation of Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), suggesting platform-specific code paths in the Chromoting network stack on Linux systems. Use-after-free vulnerabilities are particularly dangerous as they provide reliable primitives for achieving arbitrary code execution when successfully exploited.

RemediationAI

Update Google Chrome on Linux systems to version 148.0.7778.96 or later immediately. Chrome typically auto-updates within 24-48 hours of release; force an immediate update by navigating to chrome://settings/help and clicking 'Relaunch' when prompted. For enterprise deployments using managed Chrome installations, push the update through existing patch management systems (GPO, SCCM, or Linux package managers). Verify successful update by confirming version number at chrome://settings/help shows 148.0.7778.96 or higher. If immediate patching is not feasible, disable Chrome Remote Desktop as a temporary mitigation by removing the Chrome Remote Desktop extension and blocking chromeremotedesktop.google.com at the network perimeter-this eliminates the attack surface but prevents legitimate remote desktop functionality. Do not rely on network segmentation alone as the vulnerability can be triggered through man-in-the-middle attacks on legitimate sessions. Full advisory: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.