This vulnerability involves a use-after-free condition in the WebRTC implementation of Google Chrome before version 148.0.7778.96. Exploitation requires a remote attacker to deliver a specially crafted HTML page that triggers the flaw, potentially leading to arbitrary code execution inside the sandboxed environment of the browser. The issue was publicly disclosed on May 6, 2026, and is tracked as CVE-2026-7987. While the Chromium security team rates this vulnerability as medium severity, no CVSS score or detailed remediation status is provided in the available data. The vendor advisory URL points to a stable channel update announcement but does not explicitly confirm a fix for this specific vulnerability.

Successful exploitation could allow a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the security of the affected system. However, the impact is limited by the sandbox containment and the medium severity rating assigned by Chromium security. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to the latest stable version of Google Chrome once the fix is confirmed available. Until then, avoid visiting untrusted or suspicious websites that might host crafted HTML content exploiting this vulnerability.