Google Chrome CVE-2026-7988

Exploitation requires the victim to actively visit a malicious or compromised website containing attacker-crafted HTML invoking WebRTC functionality. No special Chrome configuration, extensions, or non-default settings are required - the vulnerability affects default Chrome installations. WebRTC is enabled by default in all standard Chrome deployments. Attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation is straightforward once the victim accesses the malicious page. Key limiting factors: mandatory user interaction (UI:R) prevents fully automated remote exploitation and requires social engineering to deliver victims to the attack page; sandbox scope (S:U) confines successful exploitation to within Chrome's security sandbox, preventing direct system-level access; Chromium's 'Medium' severity suggests additional mitigations (ASLR, DEP, site isolation) may increase practical exploitation difficulty beyond the CVSS score indicates.

Real-world risk is elevated but constrained by several factors requiring careful analysis. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) indicates network-based attack with low complexity and no authentication, but mandatory user interaction (visiting malicious page). The UI:R requirement significantly reduces automated exploitation potential. Sandbox scope (S:U) means successful exploitation achieves code execution only within Chrome's restricted sandbox environment, not full system compromise - attackers would need a separate sandbox escape exploit for critical impact. No EPSS score provided, but absence from CISA KEV and no public POC identified suggests this is not yet widely exploited. SSVC technical impact is partial (sandbox-confined execution), exploitation requires social engineering (user must visit attacker page), and automatable potential is limited by UI dependency. Priority should be HIGH for patch deployment due to network attack vector and RCE capability, but this is not an emergency-tier vulnerability like actively exploited zero-days. The primary risk is targeted attacks against high-value users via phishing/watering hole campaigns combining this with sandbox escape chains.

Attacker hosts a malicious website containing crafted HTML and JavaScript that invokes WebRTC APIs with specially manipulated objects designed to trigger type confusion during peer connection establishment or media stream processing. Victim visits the attacker-controlled page (via phishing email, compromised legitimate site, or malicious advertisement). The type confusion causes Chrome's WebRTC implementation to mishandle object types in memory, allowing the attacker to execute arbitrary code within Chrome's sandbox. From this sandbox foothold, the attacker could steal in-browser data (cookies, credentials, browsing history), perform actions as the logged-in user, or combine with a sandbox escape exploit for full system compromise.