Google Chrome CVE-2026-7987

Requires user to navigate to or be redirected to an attacker-controlled website serving the crafted HTML page (CVSS UI:R). Exploitation targets default Chrome configurations with WebRTC enabled, which is standard across all installations. No special browser extensions, non-default settings, or authenticated sessions are required. Limiting factors: user must actively browse to malicious content (social engineering barrier), exploitation is confined to Chrome's renderer sandbox (limiting system-level impact without additional sandbox escape exploit), and modern Chrome site isolation features may provide some defense-in-depth by isolating renderer processes per site origin.

CVSS 8.8 (High) reflects network-based exploitation requiring no authentication but requiring user interaction (AV:N/AC:L/PR:N/UI:R), with high impact across confidentiality, integrity, and availability within the sandbox scope (S:U). The UI:R requirement means users must visit or be tricked into visiting a malicious website. Attack complexity is low (AC:L), indicating reliable exploitation once the user interaction occurs. Chromium's internal severity rating of 'Medium' suggests Google's security team assessed practical exploitation difficulty or impact limitations due to sandboxing. EPSS score not available for assessment. No CISA KEV listing indicates this is not confirmed as actively exploited in the wild, distinguishing it from vulnerabilities experiencing mass exploitation. The Chromium bug tracker reference (issues/498696266) may contain technical details but access restrictions prevent verification of exploit maturity. Real-world risk is moderate: while technically severe within the sandbox, successful exploitation requires social engineering to achieve the UI:R prerequisite, and sandbox escape would require chaining with additional vulnerabilities. Priority should be high for enterprise Chrome deployments due to widespread attack surface, but lower than vulnerabilities with confirmed active exploitation or sandbox escape capabilities.

An attacker hosts a weaponized HTML page containing crafted JavaScript that triggers WebRTC functionality in a specific sequence designed to cause the use-after-free condition. The victim visits the malicious site through phishing, malvertising, or watering hole attack. Upon page load, the exploit triggers the memory corruption in Chrome's WebRTC implementation, allowing the attacker to execute arbitrary code within the renderer sandbox, potentially stealing session tokens, exfiltrating data accessible to the browser context, or serving as the first stage in a multi-exploit chain to escape the sandbox.