What is the CVSS score of CVE-2026-7915?

CVE-2026-7915 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7915?

Yes, a patch is available for CVE-2026-7915. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-7915

EUVD-2026-27933 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Authentication Bypass Google Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:40 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient data validation in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Insufficient data validation in DevTools in Google Chrome on Android prior to version 148.0.7778.96 allows remote attackers to bypass navigation restrictions by sending a crafted HTML page, requiring user interaction to open the malicious page. The vulnerability has a low CVSS score (4.3) due to limited confidentiality impact and requirement for user click, but affects all Android users running vulnerable versions. A vendor-released patch is available.

Technical ContextAI

The vulnerability resides in the DevTools component of Chromium-based Google Chrome on the Android platform. DevTools is Chrome's built-in developer console and debugger, normally accessible only to developers but subject to various security boundaries within the browser sandbox. The root cause is insufficient validation of data passed to DevTools, allowing an attacker to craft HTML content that, when processed by the browser, bypasses navigation restrictions that should prevent unauthorized cross-origin or malicious navigation. Navigation restrictions in browsers typically enforce same-origin policy and prevent javascript: protocol abuse. The weakness is classified under authentication bypass mechanisms, suggesting the attacker can circumvent security checks meant to restrict certain navigation operations.

RemediationAI

Users should upgrade Google Chrome on Android to version 148.0.7778.96 or later, which contains the vendor-released patch. The upgrade can be performed through the Google Play Store by navigating to My apps & games, selecting Google Chrome, and tapping Update if available, or by enabling automatic updates in the Play Store settings. Organizations managing Android devices via MDM (Mobile Device Management) solutions should push Chrome updates to all devices via their management platform to ensure systematic remediation. No workarounds are available to mitigate this vulnerability without patching; however, users can reduce risk exposure by avoiding clicking links from untrusted sources and being cautious of unfamiliar websites until systems are updated. The patch does not require system restart and will take effect on next app launch.