Google Chrome CVE-2026-7928

Victim must be running Google Chrome on Windows operating system specifically, as the vulnerability does not affect Linux, macOS, or ChromeOS versions. Victim must navigate to an attacker-controlled or compromised website hosting the exploit code (UI:R - user interaction required). The malicious page must invoke WebRTC APIs with crafted parameters to trigger the use-after-free condition, requiring the victim's browser to execute attacker-supplied JavaScript. No authentication or elevated privileges are required (PR:N), and exploitation works against default Chrome configurations without requiring special settings, extensions, or feature flags to be enabled. The low attack complexity (AC:L) indicates reliable exploitation once user interaction occurs, with no dependency on race conditions or environmental variables beyond the Windows platform requirement.

Real-world risk is significant but contained by Chrome's defense-in-depth architecture. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) indicates network-reachable exploitation with low complexity requiring only user interaction (visiting a malicious page). The UI:R component is critical: exploitation requires victims to navigate to attacker-controlled content, reducing automatable mass exploitation compared to purely network-driven attacks. No CISA KEV listing suggests either limited observed exploitation or insufficient time since disclosure for widespread campaigns. Google's proprietary 'High' severity rating aligns with CVSS assessment. The sandbox containment (S:U - unchanged scope) means initial exploitation is confined to Chrome's renderer process, requiring additional sandbox escape vulnerabilities for system-level compromise. Patch availability since version 148.0.7778.96 significantly reduces window of exposure for organizations with rapid update cycles. Priority should be high for Windows Chrome deployments, particularly in environments where users frequently interact with untrusted web content. The combination of low attack complexity, no authentication requirement, and RCE capability makes this a legitimate priority despite sandbox mitigation.

An attacker hosts a malicious website or injects JavaScript into a compromised legitimate site. When a Windows Chrome user visits the page, attacker-controlled HTML/JavaScript initiates a WebRTC peer connection with specially crafted parameters that trigger the use-after-free condition in Chrome's WebRTC implementation. The exploit manipulates freed memory to redirect code execution within the Chrome renderer sandbox, allowing arbitrary code execution constrained by sandbox permissions. From this position, the attacker could exfiltrate data accessible to the renderer process (cookies, session tokens, page content), perform actions as the logged-in user on visited sites, or chain with a sandbox escape vulnerability for full system compromise. No public POC identified at time of analysis, but the detailed Chromium issue tracker entry (504612429) may contain technical implementation details accessible to skilled exploit developers.