What is the CVSS score of CVE-2026-7925?

CVE-2026-7925 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7925?

Chrome Remote Desktop on Windows contains a use-after-free vulnerability (CVE-2026-7925) that allows local attackers to escalate privileges to SYSTEM level through malicious file handling, directly…. A patch is available.

How to fix or mitigate CVE-2026-7925?

Within 24 hours: Identify all Windows systems running Chrome Remote Desktop (Chromoting) and inventory current versions below 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all affected Windows endpoints via your standard patch management process; prioritize multi-user systems and those with sensitive data access. Within 30 days: Verify 100% patch compliance through vulnerability scanning and confirm no systems remain on vulnerable versions.

Google Chrome CVE-2026-7925

EUVD-2026-27953 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Microsoft Use After Free Memory Corruption Privilege Escalation Google Red Hat Suse Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:27 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

AnalysisAI

Use-after-free memory corruption in Chrome Remote Desktop (Chromoting) on Windows enables local privilege escalation to SYSTEM via malicious file interaction. Attackers with local access can gain OS-level administrative control by inducing users to open specially crafted files processed by the Chromoting component. Patch available in Chrome 148.0.7778.96. No evidence of active exploitation (not in CISA KEV), but the local attack vector with low complexity and high impact warrants immediate patching for Windows Chrome deployments, especially in multi-user environments where privilege boundaries are critical.

Technical ContextAI

Chrome Remote Desktop (Chromoting) is Google Chrome's built-in remote access technology allowing users to access computers remotely. The vulnerability stems from CWE-416 (Use After Free), a memory safety issue where code continues to reference memory after it has been freed, creating exploitable conditions. On Windows, the Chromoting component improperly handles memory lifecycle when processing certain file types, leaving dangling pointers that can be manipulated. Use-after-free bugs are particularly dangerous in privileged processes because successful exploitation allows attackers to control program execution flow, bypass security boundaries, and execute arbitrary code with elevated privileges. The CPE identifier cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome versions prior to the patched release are affected, but the Windows-specific nature limits scope to that platform only.

RemediationAI

Immediately update Google Chrome to version 148.0.7778.96 or later on all Windows systems. Chrome's automatic update mechanism typically applies patches within 24-48 hours for devices with regular internet connectivity; verify deployment using chrome://settings/help. For enterprise environments using managed deployments, push the updated version through Google Chrome Enterprise policies or existing software distribution tools. Until patching is complete, implement compensating controls: disable Chrome Remote Desktop feature if not business-critical (chrome://extensions, remove or disable 'Chrome Remote Desktop' extension), restrict user ability to open untrusted files through application whitelisting or Windows Defender Application Control, and enforce standard user accounts rather than local administrator privileges to limit post-exploitation impact even if the vulnerability is triggered. Note that disabling Chromoting eliminates the vulnerable code path but breaks remote access functionality. Vendor advisory and release notes: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Monitor Chromium issue 501833981 for additional technical details as embargo lifts.