What is the CVSS score of CVE-2026-7906?

CVE-2026-7906 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7906?

Google Chrome versions before 148.0.7778.96 contain a remote code execution vulnerability in SVG rendering that allows attackers to execute arbitrary code within the browser sandbox when users visit…. A patch is available.

How to fix or mitigate CVE-2026-7906?

Within 24 hours: Inventory Chrome deployments across the organization and identify users on versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later via your standard patch management process (auto-update for consumer instances, MDM/SCCM for enterprise fleets). Within 30 days: Verify 100% deployment completion through audit logging and endpoint management dashboards; document remediation status for compliance records.

Google Chrome CVE-2026-7906

EUVD-2026-27915 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:23 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.96 allows attackers to execute arbitrary code within the browser's sandbox through a use-after-free vulnerability in SVG rendering. User interaction (visiting a malicious webpage) is required, but no authentication is needed. Vendor-released patch available in Chrome 148.0.7778.96. No public exploit identified at time of analysis, though CVSS score of 8.8 reflects high impact if successfully exploited.

Technical ContextAI

This vulnerability stems from a use-after-free condition (CWE-416) in Chrome's SVG (Scalable Vector Graphics) rendering engine. Use-after-free vulnerabilities occur when code continues to reference memory after it has been freed, allowing attackers to manipulate freed memory contents and potentially redirect program execution flow. SVG processing involves complex parsing and rendering of vector graphics, which requires dynamic memory allocation and deallocation. The affected component is identified in Chromium bug tracker issue 496284584. The vulnerability affects the Chrome browser (CPE: cpe:2.3:a:google:chrome) across all platforms where SVG rendering is implemented, making it a cross-platform memory corruption issue in a core browser rendering component.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome's automatic update mechanism will deploy this fix automatically for most users-verify by navigating to chrome://settings/help and confirming version number. For enterprise deployments using managed updates, expedite deployment of version 148.0.7778.96 through existing patch management systems. Vendor advisory available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. If immediate patching is not feasible, implement temporary compensating controls: disable JavaScript for untrusted sites via Site Settings (reduces attack surface but breaks significant web functionality), deploy browser isolation technology to contain potential compromises, or restrict browsing to trusted domains only via enterprise policy (severely limits usability). These workarounds significantly degrade user experience and should only be temporary measures until patching is completed.