What is the CVSS score of CVE-2026-7928?

CVE-2026-7928 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7928?

Google Chrome for Windows versions below 148.0.7778.96 contain a critical remote code execution vulnerability in WebRTC that allows unauthenticated attackers to execute arbitrary code through…. A patch is available.

How to fix or mitigate CVE-2026-7928?

Within 24 hours: Verify Chrome version across all Windows endpoints using your endpoint management platform and identify devices below version 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via Group Policy, SCCM, or your standard patch management process to all Windows endpoints; prioritize critical and high-risk systems first. Within 30 days: Confirm 100% patch compliance through automated scanning and audit logs; implement browser update policies to enforce automatic updates or require administrator approval for Chrome versions older than N-2 releases.

Google Chrome CVE-2026-7928

EUVD-2026-27959 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Microsoft Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:28 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome for Windows below version 148.0.7778.96 allows unauthenticated attackers to execute arbitrary code within Chrome's sandbox via specially crafted HTML pages exploiting a use-after-free vulnerability in the WebRTC implementation. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability. EPSS data not provided, but Google's 'High' severity classification and immediate patch release indicate active concern. No CISA KEV listing or public POC identified at time of analysis, though the vulnerability is already patched.

Technical ContextAI

WebRTC (Web Real-Time Communication) is a collection of protocols and APIs enabling peer-to-peer audio, video, and data sharing in web browsers without requiring plugins. This vulnerability stems from a use-after-free condition (CWE-416), a memory corruption bug where code continues to reference memory after it has been freed, leading to undefined behavior. In Chrome's implementation on Windows, the freed memory can be reallocated and controlled by an attacker through crafted HTML/JavaScript, allowing manipulation of execution flow. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies all Chrome versions prior to the fix as affected. WebRTC's complexity in managing multimedia streams, peer connections, and data channels creates a large attack surface for memory management errors. Chrome's sandbox architecture limits the initial impact to sandbox escape attempts rather than direct system compromise.

RemediationAI

Immediately upgrade Google Chrome on Windows to version 148.0.7778.96 or later through Chrome's built-in update mechanism (Settings > About Chrome) or by downloading the latest stable release from google.com/chrome. Enterprise deployments should push the update via existing software distribution channels and verify installation across all Windows endpoints. For environments unable to patch immediately, implement compensating controls: restrict web browsing to trusted sites only via proxy filtering or DNS policies (trade-off: significant user productivity impact), disable WebRTC entirely via Chrome policy 'WebRtcUdpPortRange' set to empty string (trade-off: breaks legitimate video conferencing and WebRTC applications like Google Meet, Microsoft Teams web client), or deploy application control solutions to block execution of untrusted HTML content (trade-off: requires tuning to avoid false positives). Official advisory and technical details available at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and Chromium issue tracker https://issues.chromium.org/issues/504612429.