What is the CVSS score of CVE-2026-7902?

CVE-2026-7902 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7902?

CVE-2026-7902 is a high-severity remote code execution vulnerability in Chrome's V8 JavaScript engine affecting all versions below 148.0.7778.96.. A patch is available.

How to fix or mitigate CVE-2026-7902?

Within 24 hours: Identify Chrome deployment scope across endpoints using asset management tools and enable auto-updates if disabled. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via Mobile Device Management (MDM), Group Policy, or enterprise deployment tools to 100% of Chrome-using endpoints. Within 30 days: Verify patch deployment completion through vulnerability scanning and audit logs; monitor for exploitation attempts using endpoint detection and response (EDR) telemetry filtering for V8 sandbox escape indicators.

Google Chrome CVE-2026-7902

EUVD-2026-27907 HIGH

Out-of-bounds Write (CWE-787)

2026-05-06 Chrome

RCE Google Memory Corruption Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:22 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within Chrome's V8 sandbox affects all versions prior to 148.0.7778.96 when users visit malicious web pages. The out-of-bounds memory access vulnerability in V8 JavaScript engine enables arbitrary code execution with user interaction (visiting crafted HTML), rated high severity by Chromium team. EPSS and KEV data not available, but Google confirmed the vulnerability and released patches. Attack complexity is low (CVSS AC:L) with no authentication required, making this exploitable at scale once proof-of-concept becomes public.

Technical ContextAI

V8 is Google's open-source JavaScript and WebAssembly engine that powers Chrome and Node.js, responsible for executing JavaScript code in web pages. This vulnerability involves out-of-bounds memory access (likely buffer overflow or type confusion based on V8 historical patterns), where the engine accesses memory outside allocated boundaries when processing specially crafted JavaScript within HTML pages. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Google Chrome as the affected product across all platforms. While no CWE is assigned, typical V8 OOB vulnerabilities fall under CWE-125 (Out-of-bounds Read) or CWE-787 (Out-of-bounds Write). The sandboxed execution context (S:U in CVSS) means exploitation is contained within Chrome's renderer process initially, though combined with sandbox escape exploits this becomes a full system compromise vector.

RemediationAI

Immediately update Google Chrome to version 148.0.7778.96 or later via chrome://settings/help or allow automatic updates to apply (typically within 24-48 hours). For enterprise deployments using managed Chrome, push version 148.0.7778.96 through group policy or mobile device management systems as documented in Google's Chrome Enterprise release notes at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Users of Chromium-based browsers should check vendor advisories and update to equivalent patched versions when available. No workarounds exist that maintain full browser functionality - the only compensating control is restricting web access to trusted domains via allowlist proxies, which severely impacts usability and breaks cloud applications. Organizations unable to patch immediately should deploy browser isolation solutions (remote browser technology) to contain rendering in cloud-based sandboxes, though this introduces latency and requires infrastructure investment. Extended Stable channel users should verify their update schedule includes this security fix.