What is the CVSS score of CVE-2026-8016?

CVE-2026-8016 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-8016?

Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability in WebRTC that could allow attackers to execute arbitrary code within the browser sandbox if users visit a…. A patch is available.

How to fix or mitigate CVE-2026-8016?

Within 24 hours: Audit Chrome deployment across enterprise endpoints and identify all instances running versions below 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later via your standard patch management process; prioritize systems where Chrome is used for accessing untrusted content. Within 30 days: Verify patch deployment completion and confirm 100% of managed Chrome installations are at the patched version.

Google Chrome CVE-2026-8016

EUVD-2026-28135 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:36 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

UNKNOWN (no severity yet)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution within Chrome's sandbox allows arbitrary code execution via a malicious HTML page exploiting a use-after-free vulnerability in WebRTC. Affects Chrome versions prior to 148.0.7778.96. Despite high CVSS 8.8 scoring and RCE capability, exploitation requires user interaction (visiting a crafted page) and is confined to Chrome's sandbox, limiting system-level impact. Vendor patch released in Chrome 148.0.7778.96. No evidence of active exploitation (not in CISA KEV) or public POC at time of analysis, though Chromium security team rated this as Low severity internally, suggesting limited real-world exploitability despite the technical impact.

Technical ContextAI

This vulnerability stems from a use-after-free condition (CWE-416) in Chrome's WebRTC implementation, the real-time communication framework enabling peer-to-peer audio/video and data channels in browsers. Use-after-free occurs when code continues referencing memory after it has been freed, allowing attackers to manipulate deallocated memory regions. In WebRTC's complex asynchronous architecture with multiple threads managing media streams, connection states, and callbacks, improper object lifetime management can create windows where freed objects are accessed. The affected component (cpe:2.3:a:google:chrome) spans all platforms running Chrome's Blink rendering engine. While memory corruption vulnerabilities in WebRTC are serious due to its network-facing attack surface and complex C++ codebase, Chrome's multi-layered sandbox architecture significantly constrains post-exploitation capabilities, requiring additional sandbox escape exploits for system-level compromise.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, released via the May 2026 Stable Channel update available at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's automatic update mechanism will deploy this patch to most users within days. Enterprise administrators should verify update policies allow Chrome 148.x deployment and force updates via Group Policy (Windows) or MDM profiles (macOS/ChromeOS). For environments unable to immediately update, temporary compensating controls include disabling WebRTC via chrome://flags/#disable-webrtc (trade-off: breaks video conferencing and peer-to-peer features in web applications like Google Meet, Zoom web client, WebRTC-based collaboration tools) or deploying browser isolation solutions that sandbox Chrome processes in virtualized containers (trade-off: performance overhead, deployment complexity). Content Security Policy headers restricting script execution provide minimal protection since exploitation requires only HTML page rendering. Given Chromium's Low internal severity rating and sandbox containment, standard patch deployment timelines are appropriate rather than emergency out-of-band updates.