Skip to main content

Google Chrome CVE-2026-7903

| EUVDEUVD-2026-27909 HIGH
External Control of Assumed-Immutable Web Parameter (CWE-472)
2026-05-06 Chrome
Microsoft Google Buffer Overflow Red Hat Suse Chrome
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
May 06, 2026 - 22:22 vuln.today
CVSS changed
May 06, 2026 - 22:22 NVD
8.8 (HIGH)
CVE Published
May 06, 2026 - 18:12 nvd
HIGH 8.8

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome on Mac,Windows prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Integer overflow in Chrome's ANGLE graphics layer (Mac/Windows) enables heap corruption via malicious web pages. Remote attackers can achieve arbitrary code execution by tricking users into visiting crafted HTML content. Google patched this in Chrome 148.0.7778.96, marking it high severity. Users must interact with the malicious page, but no authentication is required. EPSS data not available; no CISA KEV listing indicates exploitation not yet confirmed in the wild, though the Chromium bug tracker may contain additional context.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's OpenGL ES implementation that translates OpenGL ES API calls to native graphics APIs (DirectX on Windows, Metal on macOS). The CWE-472 classification indicates an external control of assumed-immutable data vulnerability manifesting as an integer overflow. When processing graphics operations from untrusted HTML/JavaScript, insufficient validation of integer values in ANGLE's rendering pipeline allows attacker-controlled inputs to overflow, corrupting heap memory structures. This class of vulnerability in graphics subsystems is particularly dangerous because browsers render content from arbitrary origins, and ANGLE processes data in the renderer process sandbox context.

RemediationAI

Upgrade to Google Chrome 148.0.7778.96 or later immediately via chrome://settings/help or allow automatic updates to apply (Chrome's default behavior updates within hours of release). Organizations using managed Chrome deployments should push updates via Google Update policies or enterprise MSI/PKG installers available from https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. For air-gapped environments unable to update immediately, disable JavaScript for untrusted sites via chrome://settings/content/javascript as a temporary control, though this breaks significant web functionality and does not fully mitigate renderer-process attacks. Network-level isolation of affected systems from untrusted web content provides defense-in-depth but is impractical for general workforce browsing. No workaround fully substitutes for patching given ANGLE's foundational role in Chrome's rendering architecture.

More in Chrome

View all
CVE-2015-5122 CRITICAL POC
9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
CVE-2016-5198 HIGH POC
8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH POC
8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
CVE-2016-1646 HIGH POC
8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2017-5030 HIGH POC
8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2015-5123 CRITICAL
9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-472 – External Control of Assumed-Immutable Web Parameter

View all
CVE-2025-35939 MEDIUM
6.9
CVE-2017-5260 HIGH POC
8.8
CVE-2017-5261 HIGH POC
8.8
CVE-2024-7025 HIGH POC
8.8
CVE-2025-43933 CRITICAL
9.8
CVE-2025-43930 CRITICAL
9.8
CVE-2024-25153 CRITICAL
9.8
CVE-2021-1295 CRITICAL
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High

Share

CVE-2026-7903 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy