What is the CVSS score of CVE-2026-7901?

CVE-2026-7901 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7901?

Google Chrome for macOS versions prior to 148.0.7778.96 contains a remote code execution vulnerability in the ANGLE graphics library that allows attackers to execute arbitrary code within the browser…. A patch is available.

How to fix or mitigate CVE-2026-7901?

Within 24 hours: Identify all macOS endpoints running Chrome versions prior to 148.0.7778.96 using MDM or asset inventory tools. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all macOS devices via automatic updates or forced deployment through organization-wide settings (chrome://settings/help triggers auto-update). Within 30 days: Verify 100% compliance through endpoint monitoring; audit Chrome version compliance reports to confirm no instances of versions prior to 148.0.7778.96 remain in the environment.

Google Chrome CVE-2026-7901

EUVD-2026-27905 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:22 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome for macOS (versions prior to 148.0.7778.96) allows attackers to execute arbitrary code within the browser's sandbox by exploiting a use-after-free vulnerability in the ANGLE graphics library through a malicious HTML page. The vulnerability requires user interaction (visiting a crafted webpage) but can be exploited remotely without authentication. Google has released Chrome 148.0.7778.96 to address this high-severity memory corruption issue, which affects the confidentiality, integrity, and availability of sandboxed browser processes.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's OpenGL ES implementation that translates OpenGL ES API calls to native graphics APIs (Metal on macOS). The use-after-free vulnerability (CWE-416) occurs when ANGLE attempts to access memory after it has been deallocated, creating a window for memory corruption. This class of vulnerability in graphics libraries is particularly dangerous because GPU acceleration and WebGL rendering operate with elevated privileges within the browser's sandbox. The affected component processes untrusted web content including WebGL shaders, canvas operations, and hardware-accelerated graphics rendering, making it an attractive target for sandbox escape attempts when chained with additional vulnerabilities.

RemediationAI

Update Google Chrome for macOS to version 148.0.7778.96 or later immediately through Chrome's built-in updater (Settings → About Chrome) or by downloading the latest stable release from google.com/chrome. Chrome typically auto-updates within 24-48 hours of release, but administrators should force updates in enterprise environments using Google Update policies. Official vendor advisory: http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Technical details in Chromium bug tracker: https://issues.chromium.org/issues/497724490 (access may be restricted until broad patch deployment). No effective workarounds exist beyond updating-disabling WebGL or hardware acceleration would severely degrade browser functionality and user experience while providing incomplete protection since ANGLE handles broader graphics operations. Organizations unable to immediately patch should consider restricting Chrome usage to trusted websites only until update deployment completes, though this provides limited protection against watering hole or compromised legitimate sites.