What is the CVSS score of CVE-2026-7913?

CVE-2026-7913 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7913?

Google Chrome for Android versions prior to 148.0.7778.96 contain a local privilege escalation vulnerability that allows attackers to gain elevated system permissions through malicious files,…. A patch is available.

How to fix or mitigate CVE-2026-7913?

Within 24 hours: Inventory all Android devices running Chrome and identify current versions via mobile device management (MDM) tools. Within 7 days: Deploy Chrome version 148.0.7778.96 or later through your MDM solution or app store distribution channel, prioritizing corporate-managed devices and devices with elevated access. Within 30 days: Verify patch deployment across 100% of inventory and implement user awareness training on avoiding untrusted file sources.

Google Chrome CVE-2026-7913

EUVD-2026-27929 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Privilege Escalation Google Red Hat Suse Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:24 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 7.8

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

AnalysisAI

Local privilege escalation in Google Chrome for Android prior to 148.0.7778.96 allows attackers to elevate privileges through malicious files exploiting insufficient policy enforcement in DevTools. The vulnerability requires user interaction to open a crafted file but grants no authentication requirement (PR:N) for the initial attack vector. Google released patch version 148.0.7778.96 addressing this high-severity flaw. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting exploitation remains theoretical or non-widespread.

Technical ContextAI

This vulnerability stems from CWE-693 (Protection Mechanism Failure) in Chrome's DevTools implementation on Android. The affected component is cpe:2.3:a:google:chrome (all versions prior to 148.0.7778.96 on Android platform). DevTools in Chrome provides developer debugging and inspection capabilities that typically operate with elevated privileges to inspect application state, modify runtime behavior, and access system resources. Insufficient policy enforcement means the security boundaries between DevTools' privileged context and user-controlled file input were not properly validated. When a malicious file is processed by DevTools on Android, the lack of proper sandboxing or permission checks allows the attacker-controlled content to escape intended restrictions and execute operations at a higher privilege level than the initial file-opening context. This represents a classic privilege boundary violation where trust assumptions about file content were not properly enforced by security policies.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.96 or later immediately, as confirmed by Google's stable channel update advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. For managed Android fleets, push the update through MDM/EMM platforms and verify installation via device compliance policies. If immediate patching is not feasible, implement compensating controls: (1) Disable Chrome DevTools on managed Android devices via Chrome policy management (chrome://policy) by setting DeveloperToolsAvailability to 2 (disallow DevTools entirely) - this eliminates the attack surface but prevents legitimate developer debugging. (2) Deploy mobile threat defense solutions that scan files before opening and block execution of suspicious content targeting browser developer features. (3) Enforce strict application allowlisting to prevent installation of file manager apps that could facilitate malicious file delivery to DevTools. (4) User training to never open unknown files in Chrome DevTools, though UI:R dependency makes this a weak control. Note that disabling DevTools significantly impacts developer productivity and should only be applied to non-developer device populations.