What is the CVSS score of CVE-2026-7988?

CVE-2026-7988 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7988?

Google Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability in WebRTC that allows attackers to execute arbitrary code within the browser sandbox when users visit…. A patch is available.

How to fix or mitigate CVE-2026-7988?

Within 24 hours: Verify current Chrome version deployment across endpoints using your endpoint management system. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all managed endpoints via your standard browser update mechanism (Windows Update, SCCM, MDM, or Chrome Enterprise auto-update). Within 30 days: Audit deployment completion and confirm 100% of Chrome installations are at version 148.0.7778.96 or later; document exceptions for any legacy systems unable to patch.

Google Chrome CVE-2026-7988

EUVD-2026-28079 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-06 Chrome

Memory Corruption Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:33 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's WebRTC implementation (versions prior to 148.0.7778.96) allows attackers to execute arbitrary code within the browser sandbox through a malicious HTML page exploiting type confusion in WebRTC. Patch available via Chrome 148.0.7778.96. Requires user interaction (visiting crafted page) but no authentication. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability within sandbox constraints. No confirmed active exploitation or public POC identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-843 (Type Confusion), a memory corruption class where code incorrectly handles an object as a different type than intended. WebRTC (Web Real-Time Communication) is Chrome's implementation of peer-to-peer audio, video, and data communication APIs used by web applications for videoconferencing and real-time collaboration. Type confusion vulnerabilities in WebRTC typically occur during complex object handling in media stream processing, codec negotiation, or peer connection establishment. When exploited, the type mismatch causes the browser to misinterpret memory structures, potentially allowing controlled memory writes that lead to code execution. The CPE string cpe:2.3:a:google:chrome identifies all Chrome browser installations across platforms (Windows, macOS, Linux, ChromeOS) as affected prior to the patched version. Chromium's security severity rating of 'Medium' (contrasting with CVSS 8.8 'High') likely reflects sandboxing effectiveness limiting post-exploitation impact.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via Chrome's built-in automatic update mechanism (chrome://settings/help) or manual download from google.com/chrome. Chrome typically auto-updates within 24-48 hours for most users. Enterprise deployments should push Chrome 148.0.7778.96 through managed update channels (GPO/SCCM/MDM). For environments unable to immediately patch, compensating controls include: disabling JavaScript via chrome://settings/content/javascript (breaks most web applications - only viable for limited-use kiosks), blocking access to untrusted websites through web proxy/firewall rules (reduces social engineering attack surface but requires maintaining allowlists), or restricting WebRTC functionality via Chrome policy WebRtcUdpPortRange (empty value disables WebRTC - impacts videoconferencing/collaboration tools). Official advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and technical details at https://issues.chromium.org/issues/498753456 provide vendor confirmation.