What is the CVSS score of CVE-2026-7907?

CVE-2026-7907 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7907?

CVE-2026-7907 is a high-severity remote code execution vulnerability in Google Chrome affecting all versions below 148.0.7778.96, exploitable through malicious webpages without user authentication…. A patch is available.

How to fix or mitigate CVE-2026-7907?

Within 24 hours: Verify current Chrome versions across your organization using endpoint management tools and identify devices running versions below 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via your standard patch management process to all affected systems; prioritize high-risk users and systems accessing sensitive data. Within 30 days: Complete deployment verification across 100% of Chrome installations and audit security event logs for any exploitation indicators during the patching window.

Google Chrome CVE-2026-7907

EUVD-2026-27917 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:23 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution within Chrome's sandbox affects all versions prior to 148.0.7778.96 via crafted HTML pages exploiting a use-after-free vulnerability in DOM handling. Remote unauthenticated attackers can achieve arbitrary code execution with high integrity and confidentiality impact by convincing users to visit a malicious webpage. Vendor patch released (Chrome 148.0.7778.96). No confirmed active exploitation (not in CISA KEV), but the low attack complexity (AC:L) and publicly disclosed bug tracker entry (Chromium issue 496292089) increase exploitation risk. EPSS data not provided but RCE in widely-deployed browser warrants immediate patching despite sandbox containment limiting full system compromise.

Technical ContextAI

This is a use-after-free (CWE-416) memory corruption vulnerability in Chrome's Document Object Model (DOM) implementation. Use-after-free bugs occur when code continues to use a memory pointer after the referenced object has been deallocated, allowing attackers to manipulate freed memory and redirect program execution. The DOM subsystem manages the tree structure of HTML/XML documents in the browser rendering engine. According to CPE data (cpe:2.3:a:google:chrome), this affects the core Chrome browser application across all supported platforms. The vulnerability exists in Chromium's DOM handling code, as evidenced by the Chromium bug tracker reference (issues/496292089). While exploitation occurs within Chrome's sandbox security boundary (limiting system-level access), successful exploitation still achieves arbitrary code execution within the renderer process context, potentially enabling data exfiltration from the current browsing session, cross-origin attacks, or sandbox escape when chained with additional vulnerabilities.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome typically auto-updates within 24-48 hours of release; users can force immediate update by navigating to chrome://settings/help and clicking 'Relaunch' when update is available. Enterprise deployments using managed Chrome should push version 148.0.7778.96 through group policy or mobile device management systems. Official vendor advisory with complete update instructions is available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. For environments where immediate patching is not feasible, implement compensating controls: (1) restrict web browsing to trusted sites only via DNS filtering or web proxy whitelist policies (trade-off: significantly reduced productivity and user experience), (2) deploy Chrome Enterprise with SitePerProcess isolation enabled to enhance sandbox boundaries (trade-off: increased memory consumption ~10-20%), or (3) temporarily switch to alternative browsers until Chrome can be updated (trade-off: compatibility issues with Chrome-specific web applications). Technical details in Chromium issue tracker (https://issues.chromium.org/issues/496292089) may assist security teams in developing detection signatures for exploitation attempts, though access restrictions may apply.