What is the CVSS score of CVE-2026-7980?

CVE-2026-7980 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7980?

Google Chrome versions before 148.0.7778.96 contain a high-severity remote code execution vulnerability in WebAudio that can be exploited when users visit malicious websites, potentially allowing…. A patch is available.

How to fix or mitigate CVE-2026-7980?

Within 24 hours: Verify current Chrome deployment versions across your environment and identify systems running versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all user endpoints through your standard patch management process; prioritize administrative and executive users. Within 30 days: Complete deployment to 100% of Chrome installations and validate via endpoint inventory tools that no systems remain on vulnerable versions.

Google Chrome CVE-2026-7980

EUVD-2026-28063 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:32 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's WebAudio implementation (versions before 148.0.7778.96) allows attackers to execute arbitrary code within the browser sandbox by exploiting a use-after-free vulnerability through a malicious HTML page. The vulnerability requires user interaction (visiting a crafted page) but no authentication. Google has released Chrome 148.0.7778.96 to address this issue. EPSS data not available; no KEV listing or public POC identified at time of analysis, suggesting limited real-world exploitation observed despite the high CVSS score.

Technical ContextAI

This vulnerability affects the WebAudio API implementation in Chrome, a powerful browser API for processing and synthesizing audio. The root cause is CWE-416 (Use After Free), a memory corruption class where code references memory after it has been deallocated. In browser contexts, UAF bugs typically occur when JavaScript object lifecycle management fails to properly track references to underlying C++ objects. When a crafted HTML page triggers specific WebAudio operations, the browser attempts to access freed memory, allowing an attacker to control the contents of that memory location. While Chrome's multi-process architecture and sandbox limit the impact to code execution within the renderer sandbox (not full system compromise), UAF primitives are frequently chained with sandbox escape exploits in sophisticated attacks. The CPE string cpe:2.3:a:google:chrome confirms this affects the Chrome browser application across all supported platforms.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.96. Immediately update Google Chrome to version 148.0.7778.96 or later through Chrome's built-in updater (Settings → About Chrome) or enterprise deployment tools like Google Update for Windows or Mobile Device Management systems. Chrome's auto-update mechanism typically applies patches within 24-48 hours for consumer installations. For enterprise environments unable to patch immediately, implement compensating controls: deploy browser isolation technology (remote browser isolation/RBI) to execute untrusted web content in isolated cloud environments, configure Content Security Policy headers to restrict JavaScript execution on internal applications, and block access to known-malicious domains via DNS filtering or web proxy. Note that disabling JavaScript entirely breaks most modern web applications. Disabling WebAudio specifically is not exposed as a configurable policy in Chrome. Organizations should prioritize standard patch deployment over workarounds given the sandbox containment. Reference the official advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for deployment guidance.