What is the CVSS score of CVE-2026-7929?

CVE-2026-7929 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7929?

Google Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability in the MediaRecording component that allows attackers to execute arbitrary code through malicious webpages…. A patch is available.

How to fix or mitigate CVE-2026-7929?

Within 24 hours: Verify current Chrome version distribution across endpoints using mobile device management or endpoint management tools and identify all systems running versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all affected endpoints through standard update mechanisms or managed deployment tools; prioritize user-facing workstations and systems with elevated data access. Within 30 days: Confirm 100% deployment completion through compliance scanning; document patch deployment in change management system and security audit logs.

Google Chrome CVE-2026-7929

EUVD-2026-27961 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:28 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in MediaRecording in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's MediaRecording component (versions prior to 148.0.7778.96) allows attackers to execute arbitrary code when victims perform specific UI interactions with a malicious webpage. The use-after-free vulnerability in memory management has been patched by Google in version 148.0.7778.96. EPSS data not available; no CISA KEV listing identified, suggesting no confirmed widespread exploitation at time of analysis, though publicly available exploit code exists per Chromium bug tracker disclosure.

Technical ContextAI

This is a use-after-free (CWE-416) vulnerability in Chrome's MediaRecording API implementation, which handles media capture and recording from web pages (getUserMedia, MediaRecorder). Use-after-free occurs when code continues to use a memory reference after it has been freed, allowing attackers to manipulate freed memory contents. In browser contexts, this class of memory corruption often leads to arbitrary code execution by overwriting freed memory with attacker-controlled data. The vulnerability exists in the core MediaRecording component shared across all Chrome platforms (Windows, macOS, Linux, ChromeOS). Affected product identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with version range <148.0.7778.96.

RemediationAI

Immediately update Google Chrome to version 148.0.7778.96 or later via the browser's built-in update mechanism (Settings > About Chrome) or download directly from google.com/chrome. Chrome typically auto-updates within 48 hours, but manual restart is required to apply the patch. For enterprise deployments, push version 148.0.7778.96 through managed update channels. If immediate patching is not feasible, implement compensating controls: disable JavaScript for untrusted sites via Site Settings, deploy browser isolation solutions to sandbox web content in remote containers, restrict MediaRecorder API access via Chrome Enterprise Policy (URLBlocklist for untrusted domains), and train users to avoid interacting with media capture prompts on unfamiliar websites. Note that blocking JavaScript entirely may break legitimate web applications. Verify patch application by navigating to chrome://settings/help and confirming version 148.0.7778.96 or higher. Advisory references: http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/504660052.