What is the CVSS score of CVE-2026-7900?

CVE-2026-7900 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7900?

CVE-2026-7900 is a high-severity heap buffer overflow in Chrome's graphics layer that allows attackers to escape the browser sandbox once renderer process compromise is achieved, effectively…. A patch is available.

How to fix or mitigate CVE-2026-7900?

Within 24 hours: Identify Chrome deployment scope across endpoints using asset management tools and flag Chrome versions below 148.0.7778.96 for priority remediation. Within 7 days: Deploy Chrome 148.0.7778.96 or later via MDM/SCCM to all managed endpoints; communicate mandatory browser update to BYOD users. Within 30 days: Audit and close any exception requests; implement browser update policy to auto-patch within 2 weeks of vendor release.

Google Chrome CVE-2026-7900

EUVD-2026-27903 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-06 Chrome

Heap Overflow Google Buffer Overflow Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 00:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in Chrome's ANGLE graphics layer enables sandbox escape for attackers who have already compromised the renderer process, requiring user interaction with a malicious webpage. Chrome 148.0.7778.96 patches this High-severity vulnerability. No active exploitation confirmed (not in CISA KEV), and CVSS 8.3 reflects the Changed scope indicating successful sandbox breakout - a critical security boundary failure that elevates renderer compromise to broader system access.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's OpenGL ES implementation that translates graphics API calls to platform-native APIs (Direct3D on Windows, Metal on macOS, Vulkan on Linux). This CWE-122 heap buffer overflow occurs when ANGLE processes malformed graphics commands in web content, writing beyond allocated heap memory boundaries. The vulnerability exists in Chrome versions prior to 148.0.7778.96 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). Heap overflows in graphics subsystems are particularly dangerous because ANGLE runs within the renderer process but handles untrusted content - successful exploitation breaks Chrome's multi-process sandbox architecture, the primary defense against web-based attacks.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via built-in auto-update (chrome://settings/help) or direct download from google.com/chrome. Chrome's automatic update mechanism typically deploys patches within 24-48 hours for most users. For enterprise environments using managed Chrome deployments, push update policy to force version 148.0.7778.96+ across all endpoints. No effective workarounds exist for this vulnerability - disabling hardware acceleration (chrome://flags/#disable-accelerated-video-decode) does NOT mitigate ANGLE heap overflows as ANGLE handles WebGL and other graphics APIs beyond video. Compensating controls for environments unable to patch immediately: restrict Chrome usage to trusted sites only via browser policy (URLBlocklist/URLAllowlist), deploy network-layer web filtering to block known-malicious domains, and enable Chrome's Enhanced Safe Browsing mode for additional phishing/malware protection. These controls reduce attack surface but do NOT prevent exploitation if users visit attacker-controlled pages. Side effects: URL restrictions may impact legitimate business workflows; Enhanced Safe Browsing sends additional telemetry to Google. Patch deployment remains the only complete remediation. Full advisory: chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.