What is the CVSS score of CVE-2026-7987?

CVE-2026-7987 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7987?

Google Chrome versions before 148.0.7778.96 contain a remote code execution vulnerability in the WebRTC component that allows attackers to execute arbitrary code within the browser sandbox through a…. A patch is available.

How to fix or mitigate CVE-2026-7987?

Within 24 hours: Inventory all Chrome deployments across endpoints and identify current versions. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all user endpoints via your standard patch management process; configure automatic updates to the stable channel if not already enabled. Within 30 days: Verify 100% deployment completion through endpoint management tools and document patching records for compliance audit trails.

Google Chrome CVE-2026-7987

EUVD-2026-28077 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:33 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's WebRTC component (versions prior to 148.0.7778.96) allows attackers to execute arbitrary code within the browser's sandbox by exploiting a use-after-free memory corruption vulnerability via a malicious HTML page. While sandboxed, successful exploitation achieves high confidentiality, integrity, and availability impact within the renderer process. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. Vendor patch released as Chrome 148.0.7778.96.

Technical ContextAI

This vulnerability affects the WebRTC (Web Real-Time Communication) implementation in Chrome, specifically the media streaming and peer-to-peer communication framework. WebRTC enables browser-based audio, video, and data sharing without plugins. The root cause is CWE-416 (Use After Free), a memory corruption class where code attempts to access memory after it has been freed. In Chrome's multi-process architecture, WebRTC runs within the renderer sandbox, which limits the impact of successful exploitation by preventing direct system access. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome distributions are potentially affected prior to the patched version. Use-after-free vulnerabilities in browser components typically arise from improper object lifecycle management during complex asynchronous operations common in real-time communication protocols.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome's automatic update mechanism typically deploys patches within days for most users, but enterprise deployments should verify update completion through management consoles. For Windows/Mac/Linux desktop: Navigate to chrome://settings/help to trigger immediate update check and installation. For managed enterprise deployments: Push Chrome 148.0.7778.96 via group policy or mobile device management systems. For Android: Update via Google Play Store. For iOS: Update via App Store. Detailed release information available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. If immediate patching is not feasible, implement compensating controls: disable WebRTC entirely via chrome://flags/#disable-webrtc (breaks legitimate video conferencing and reduces functionality significantly), enforce strict content security policies to limit untrusted HTML content execution, or restrict browser access to only trusted domains via enterprise policies (may impact business operations requiring broad web access). No effective workaround exists that maintains full WebRTC functionality while mitigating this specific use-after-free vulnerability.