What is the CVSS score of CVE-2026-7905?

CVE-2026-7905 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7905?

Google Chrome for Android versions below 148.0.7778.96 contain a sandbox escape vulnerability in the Media component that allows attackers to gain system-level code execution after compromising the…. A patch is available.

How to fix or mitigate CVE-2026-7905?

Within 24 hours: Identify Chrome for Android deployment scope across organizational devices and BYOD programs using mobile device management (MDM) or asset inventory tools. Within 7 days: Deploy Chrome 148.0.7778.96 or later through MDM forced updates, Google Play Store settings, or organizational guidance; prioritize devices with access to corporate networks or sensitive data. Within 30 days: Verify 100% update compliance through MDM reporting; conduct security awareness training on malicious HTML pages and suspicious web content.

Google Chrome CVE-2026-7905

EUVD-2026-27913 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:23 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Renderer process compromise in Google Chrome for Android before 148.0.7778.96 enables sandbox escape through malicious HTML pages exploiting insufficient input validation in the Media component. Attacker requires user interaction to compromise the renderer first, then can break out of Chrome's security sandbox to execute code with broader system privileges. Vendor-released patch available in Chrome 148.0.7778.96 per Google's May 2026 stable channel update.

Technical ContextAI

Chrome's multi-process architecture isolates web content in sandboxed renderer processes with limited system privileges. The Media component handles audio/video playback and processing on Android. This vulnerability (CWE-20: Improper Input Validation) allows an attacker who has already compromised a renderer process to escape the sandbox boundary by sending crafted input to the Media subsystem. The CVSS scope change (S:C) confirms the attacker breaches a security boundary. Affected product identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with fix version 148.0.7778.96 confirmed by official Chrome release blog.

RemediationAI

Update Google Chrome for Android to version 148.0.7778.96 or later immediately via the Google Play Store or enterprise mobile device management systems. Verify the update by navigating to chrome://version in the browser address bar. Official advisory and patch information available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. If immediate patching is not feasible, implement compensating controls: restrict Chrome usage to trusted sites only through enterprise policies or mobile security solutions, disable automatic media playback via chrome://flags/#autoplay-policy set to 'Document user activation is required', and consider temporarily switching to an alternative browser for high-risk browsing scenarios. Note that disabling media playback significantly degrades user experience and may not fully prevent renderer compromise through other vectors. No workaround eliminates the sandbox escape risk once renderer is compromised.