What is the CVSS score of CVE-2026-7951?

CVE-2026-7951 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7951?

Google Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability in the WebRTC component that allows attackers to execute arbitrary code within the browser sandbox by…. A patch is available.

How to fix or mitigate CVE-2026-7951?

Within 24 hours: Identify all Chrome deployments across the organization and assess version compliance against 148.0.7778.96 or later. Within 7 days: Deploy Chrome version 148.0.7778.96 or higher across all endpoints via your endpoint management platform; prioritize systems handling sensitive data. Within 30 days: Verify 100% deployment completion through vulnerability scanning; document remediation in your patch management system.

Google Chrome CVE-2026-7951

EUVD-2026-28005 HIGH

Out-of-bounds Write (CWE-787)

2026-05-06 Chrome

Google Memory Corruption Buffer Overflow RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:29 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution within Chrome's sandbox affects all versions prior to 148.0.7778.96 through an out-of-bounds write in the WebRTC component. Attackers can achieve arbitrary code execution by convincing users to visit a specially crafted HTML page, though execution remains confined to Chrome's sandbox. EPSS data not available for this recent CVE (May 2026). Vendor-released patch version 148.0.7778.96 addresses the vulnerability with Chromium security severity rated Medium despite 8.8 CVSS score.

Technical ContextAI

This vulnerability exploits CWE-787 (Out-of-bounds Write) in Chrome's WebRTC implementation, the real-time communication framework enabling peer-to-peer audio, video, and data sharing in browsers. The affected component is cpe:2.3:a:google:chrome prior to version 148.0.7778.96. Out-of-bounds write vulnerabilities occur when software writes data beyond allocated memory boundaries, allowing attackers to overwrite adjacent memory regions with attacker-controlled data. In WebRTC's case, this likely involves malformed Session Description Protocol (SDP) messages, RTP packets, or ICE candidate handling that triggers memory corruption during media stream processing. The sandbox constraint means exploitation provides code execution within Chrome's restricted process environment rather than system-level compromise.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later via automatic updates or manual download from google.com/chrome. Chrome typically auto-updates within 24-48 hours of release; users can force immediate update by navigating to chrome://settings/help. Enterprise deployments should deploy version 148.0.7778.96 through managed update channels per the stable channel advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. If immediate patching is infeasible, restrict user access to untrusted websites and disable WebRTC via chrome://flags/#disable-webrtc (note: this breaks legitimate conferencing tools like Google Meet, Zoom web client, and WebRTC-based applications, making it impractical for most users). Network-level blocking of WebRTC STUN/TURN traffic (UDP ports 3478, 5349, TCP 443 for TURN-over-TLS) can limit exploitation surface but breaks WebRTC functionality entirely and may not prevent HTML-based trigger mechanisms.