What is the CVSS score of CVE-2026-7909?

CVE-2026-7909 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7909?

Yes, a patch is available for CVE-2026-7909. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7909

EUVD-2026-27921 LOW

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:40 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

3.1 (LOW)

CVE Published

May 06, 2026 - 18:12 nvd

LOW 3.1

DescriptionCVE.org

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to circumvent Chrome's site isolation security boundary through a crafted HTML page. The vulnerability requires user interaction and a pre-compromised renderer, limiting real-world impact despite being triggered remotely. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

Google Chrome's site isolation is a core security architecture that isolates renderer processes by site to prevent one compromised site from accessing data from another site. ServiceWorker is a persistent background script that runs in a worker context with limited privileges but high capability for caching and offline functionality. The vulnerability lies in improper validation within ServiceWorker implementation (CWE-693: Protection Mechanism Failure), allowing a crafted HTML page served within an already-compromised renderer process to break the isolation boundary. This implies the attack requires the renderer process itself to be exploited first, then leverages ServiceWorker logic to escape that process's confinement.

RemediationAI

Users should upgrade Google Chrome to version 148.0.7778.96 or later immediately via Chrome's built-in auto-update mechanism (Settings > About Google Chrome). Chrome typically auto-updates within hours; users can manually force the update check in the About section. No workarounds are available for this vulnerability since site isolation is a core architecture that cannot be disabled without severely compromising browser security. Given the requirement for renderer process compromise as a prerequisite, defense against this vulnerability is primarily achieved through patching Chrome itself and applying OS-level protections (OS updates, DEP/ASLR enablement) to prevent the initial renderer exploit. The chromium bug tracker and Chrome release notes (chromereleases.googleblog.com) provide detailed patch information.