What is the CVSS score of CVE-2026-7896?

CVE-2026-7896 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7896?

Google Chrome versions prior to 148.0.7778.96 contain a heap corruption vulnerability in the Blink rendering engine that allows unauthenticated remote code execution through malicious web pages,…. A patch is available.

How to fix or mitigate CVE-2026-7896?

Within 24 hours: Identify all Chrome deployments via endpoint management tools and verify current version against 148.0.7778.96. Within 7 days: Deploy Chrome update to version 148.0.7778.96 or later across all managed endpoints using your browser deployment mechanism (e.g., WSUS, MDM, or Chrome Enterprise). Within 30 days: Validate patch deployment completion and confirm no systems remain on versions prior to 148.0.7778.96; implement Chrome auto-update policy if not already enabled to prevent recurrence.

Google Chrome CVE-2026-7896

EUVD-2026-27895 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-06 Chrome

Buffer Overflow Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 00:30 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome prior to 148.0.7778.96 allows remote attackers to execute arbitrary code via a maliciously crafted HTML page exploiting an integer overflow in the Blink rendering engine. The vulnerability requires user interaction (visiting a malicious webpage) but no authentication, enabling drive-by attacks against default Chrome installations. Google has assigned this a Critical severity rating and released version 148.0.7778.96 to address the issue. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, though the technical details are publicly documented in the Chromium issue tracker.

Technical ContextAI

The vulnerability resides in Blink, Chrome's rendering engine responsible for parsing and displaying HTML, CSS, and JavaScript. An integer overflow (CWE-472) occurs when arithmetic operations produce values exceeding the maximum representable value for the integer type, potentially wrapping to small or negative values. In this case, the overflow leads to heap corruption-memory management errors in the dynamically allocated heap region. When processing specially crafted HTML, the integer overflow causes incorrect memory allocation sizes or buffer boundaries, allowing an attacker to corrupt heap metadata or adjacent objects. This class of vulnerability is particularly dangerous in browser engines because successful heap manipulation can enable arbitrary code execution within the renderer process sandbox, and potentially escape to compromise the underlying system.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via the built-in updater (Chrome menu → Help → About Google Chrome) or download from google.com/chrome. The vendor advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html confirms patch availability. Enterprise deployments should deploy the update via managed policies and verify installation across endpoints. For environments requiring temporary compensating controls during patch deployment windows: restrict web browsing to trusted sites via proxy/firewall allowlists (reduces exposure to malicious HTML but significantly impacts usability); deploy browser isolation technologies that render untrusted content in sandboxed cloud environments (effective but requires infrastructure investment); consider disabling JavaScript for untrusted sites via browser policy (may break legitimate functionality and does not fully mitigate if HTML parsing alone triggers the overflow). No server-side or network-level mitigations are effective since exploitation occurs client-side during HTML rendering. Auto-update should be enabled for consumer users to receive the patch automatically within days.