What is the CVSS score of CVE-2026-7911?

CVE-2026-7911 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7911?

CVE-2026-7911 is a high-severity sandbox escape vulnerability in Google Chrome for Windows that could allow attackers to gain system-level control after compromising the browser's renderer process.. A patch is available.

How to fix or mitigate CVE-2026-7911?

Within 24 hours: Verify current Chrome version across Windows endpoints using MDM/SCCM inventory and identify devices running versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via your endpoint management platform; prioritize systems with high-sensitivity user roles and those accessing critical business applications. Within 30 days: Confirm 100% deployment completion, validate successful installation through automated compliance reporting, and document patch deployment in your vulnerability management system.

Google Chrome CVE-2026-7911

EUVD-2026-27925 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Microsoft Use After Free Memory Corruption Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:24 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Aura in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Windows versions prior to 148.0.7778.96 allows remote attackers who have already compromised the renderer process to break out of the Chrome sandbox via a use-after-free vulnerability in the Aura UI framework. The attack requires user interaction with a specially crafted HTML page and has high attack complexity (AC:H), but grants complete control over confidentiality, integrity, and availability with changed scope (S:C). No active exploitation confirmed in CISA KEV at time of analysis. EPSS data not provided, but the vulnerability targets a browser component with over 3 billion users globally.

Technical ContextAI

This vulnerability exploits CWE-416 (Use After Free) in Aura, Google Chrome's native windowing framework used specifically on Windows platforms. A use-after-free occurs when code attempts to access memory that has already been deallocated, allowing attackers to manipulate freed memory objects to achieve arbitrary code execution. The Aura framework manages Chrome's window compositing, input handling, and UI rendering on Windows. The vulnerability exists in Chrome versions prior to 148.0.7778.96 per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The Changed Scope (S:C) in the CVSS vector indicates this is a sandbox escape - the attacker breaks out of Chrome's renderer process sandbox to compromise resources beyond the originally vulnerable component's security context.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome typically auto-updates within 24-48 hours on managed systems, but users should manually trigger updates via chrome://settings/help to ensure immediate protection. Enterprise administrators should deploy version 148.0.7778.96 through managed update channels and verify installation across Windows endpoints. Google's advisory is available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. No workarounds are available for this sandbox escape vulnerability. If immediate patching is impossible, consider temporary compensating controls: restrict Chrome usage to trusted websites only via enterprise policy (URLBlocklist/URLAllowlist), deploy Chrome in application sandboxing solutions like Windows Defender Application Guard for additional isolation layers, or temporarily switch to alternative browsers on critical Windows systems until patching is complete. Note that these mitigations significantly impact usability and do not address the underlying vulnerability if the renderer process is already compromised through other means.