What is the CVSS score of CVE-2026-7910?

CVE-2026-7910 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-7910?

Google Chrome versions before 148.0.7778.96 contain a critical use-after-free vulnerability in the Views component that allows attackers who have already compromised a renderer process to bypass site…. A patch is available.

How to fix or mitigate CVE-2026-7910?

Within 24 hours: Verify current Chrome versions across your organization using your endpoint management system; prioritize systems running versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all endpoints via your standard patch management process; enable automatic Chrome updates if not already active. Within 30 days: Audit and document Chrome deployment status to confirm 100% remediation; review any renderer isolation policies and validate site isolation remains enabled.

Google Chrome CVE-2026-7910

EUVD-2026-27923 CRITICAL

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Red Hat

7.7 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 14:52 vuln.today

CVSS changed

May 07, 2026 - 14:52 NVD

9.6 (CRITICAL)

CVE Published

May 06, 2026 - 18:12 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free in the Views component of Google Chrome versions prior to 148.0.7778.96 enables site isolation bypass after renderer compromise. A remote attacker who has already compromised the renderer process can escape sandbox protections via a malicious HTML page, potentially accessing cross-origin data or executing code outside the renderer sandbox. Patch released by Google in version 148.0.7778.96. EPSS score of 0.02% (3rd percentile) indicates very low probability of exploitation in the wild currently, with no evidence of active exploitation or public proof-of-concept at time of analysis.

Technical ContextAI

This vulnerability affects the Views UI framework in Google Chrome's Chromium engine, specifically a use-after-free condition (CWE-416) where memory is accessed after being freed. The Views component handles Chrome's user interface rendering across platforms. The critical aspect is that exploitation requires prior renderer compromise, meaning an attacker must first execute code within Chrome's renderer process sandbox before leveraging this flaw. Site isolation is Chrome's primary defense-in-depth mechanism that separates web origins into different processes to prevent cross-site data leakage. This vulnerability undermines that protection by allowing sandbox escape. The CVSS Changed Scope (S:C) metric confirms the ability to impact resources beyond the vulnerable component's security scope, consistent with a sandbox bypass. CPE data identifies all Chrome versions prior to 148.0.7778.96 as vulnerable across all platforms where Chrome runs.

RemediationAI

Immediately upgrade Google Chrome to version 148.0.7778.96 or later through Chrome's built-in update mechanism (Settings > About Chrome) or by downloading from google.com/chrome. Enterprise deployments should push version 148.0.7778.96 through centralized management tools. Official advisory available at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. For environments unable to patch immediately, implement strict site isolation enforcement via chrome://flags/#site-isolation-trial-opt-out (ensure NOT opted out), deploy Chrome in application sandboxes or virtualized environments to add additional containment layers, and restrict browsing to trusted domains through enterprise policy controls. Note that these workarounds provide only partial risk reduction since the vulnerability specifically targets site isolation itself, and disabling JavaScript would break most web functionality making it impractical. Organizations using Chromium-based browsers (Edge, Brave, Vivaldi) should verify their vendor has incorporated the upstream Chromium fix and update accordingly.