PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7925 Google CVE debrief

A use-after-free vulnerability in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allows a local attacker to perform OS-level privilege escalation via a malicious file. This vulnerability exists in the Chromoting component of Google Chrome on Windows. A local attacker can exploit this vulnerability by providing a malicious file, which can lead to OS-level privilege escalation. The vulnerability has a high severity and defenders should update Chrome, verify system configurations, and monitor for suspicious activity.

Vendor
Google
Product
Chrome
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-06
Original CVE updated
2026-10-26
Advisory published
2026-05-06
Advisory updated
2026-10-26

Who should care

Windows system administrators and users of Google Chrome on Windows should assess their exposure and verify that their systems are up-to-date with the latest security patches.

Why it matters

CVE-2026-7925 is a high-severity use-after-free vulnerability in Google Chrome's Chromoting component on Windows, allowing local attackers to escalate privileges. Defenders should update Chrome, verify system configurations, and monitor for suspicious activity.

  • Local attackers may exploit this vulnerability to escalate privileges on Windows systems
  • Successful exploitation can lead to OS-level privilege escalation
  • Defenders should prioritize updating Google Chrome to version 148.0.7778.96 or later
  • Verification of Windows system configurations and monitoring for suspicious activity is recommended

Technical summary

The vulnerability exists in the Chromoting component of Google Chrome on Windows. A local attacker can exploit this vulnerability by providing a malicious file, which can lead to OS-level privilege escalation. The vulnerability has a high severity and defenders should update Chrome, verify system configurations, and monitor for suspicious activity. The vulnerability has been reported in Google Chrome on Windows prior to version 148.0.7778.96.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 148.0.7778.96 or later
  • Verify that Windows systems running Google Chrome are up-to-date with the latest security patches
  • Monitor for suspicious activity related to malicious files on Windows systems

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability has been reported in Google Chrome on Windows prior to version 148.0.7778.96. The CVE record was published on 2026-05-06T19:16:40.833Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and affected versions. Defenders should verify that their systems are up-to-

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7925 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7925

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7925 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7925

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.