Google Chrome < 120.0.6099.224 — RCE

A type confusion bug in Chrome's WebRTC component lets an attacker run arbitrary code by getting a user to visit a malicious web page — no additional interaction needed.

Published May 7, 2026 · Updated May 10, 2026

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

An attacker can serve a malicious web page that exploits this vulnerability to execute arbitrary code in the context of the Chrome renderer process. Combined with a sandbox escape (separately available), this can lead to full system compromise. This vulnerability was confirmed exploited in the wild before the patch was released.

How the attack worksNo clicks needed

Google Chrome's WebRTC implementation contains a heap buffer overflow triggered by a type confusion bug in the media processing pipeline. WebRTC is used for video conferencing, screen sharing, and peer-to-peer communication and is enabled in all Chrome installations by default. The vulnerability can be triggered by a malicious web page without any user interaction beyond navigation.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●Any server with Chrome installed used for browsing

●Jump hosts

●RDS environments

●Running Chrome < 120.0.6099.224

Affected OS versions

Windows Server 2016Windows Server 2019Windows Server 2022

Fixed in120.0.6099.224

Real-world incidentsWhat we've seen

CVE-2023-7024 was the eighth Chrome zero-day patched by Google in 2023, demonstrating the sustained exploitation of browser vulnerabilities against high-value targets. Servers used as jump hosts or RDS environments where users browse the web are at particular risk from zero-day browser exploits.

How to patch

Manual remediation steps

⏱ 10 minutes

Check Current Version

(Get-ItemProperty 'HKLM:\SOFTWARE\Google\Chrome\BLBeacon').version

Update Chrome

Option 1 — Chrome Menu

Open Chrome

Click the three-dot menu (top right)

Click Help → About Google Chrome

Chrome will check for updates and install automatically

Click Relaunch when prompted

Option 2 — Enterprise Update

# Force update check via Google Update
$googleUpdate = 'C:\Program Files (x86)\Google\Update\GoogleUpdate.exe'
if (Test-Path $googleUpdate) {
    & $googleUpdate /ua /installsource scheduler
}

Verification

(Get-ItemProperty 'HKLM:\SOFTWARE\Google\Chrome\BLBeacon').version
# Must show 120.0.6099.224 or later

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-7024 ↗ NVD