What is the CVSS score of CVE-2026-7916?

CVE-2026-7916 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7916?

Google Chrome versions prior to 148.0.7778.96 contain a sandbox escape vulnerability that allows attackers who have already compromised a renderer process to break out of browser isolation and gain…. A patch is available.

How to fix or mitigate CVE-2026-7916?

Within 24 hours: Inventory all Chrome deployments and identify systems running versions below 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later across all affected systems; prioritize user-facing endpoints and systems accessing sensitive data. Within 30 days: Verify patch deployment via endpoint management tools and confirm no systems remain on vulnerable versions through automated scanning.

Google Chrome CVE-2026-7916

EUVD-2026-27935 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:25 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient data validation in InterestGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome prior to 148.0.7778.96 enables compromised renderer processes to break out of browser security isolation via malicious HTML. This two-stage attack requires first exploiting a separate renderer vulnerability, then leveraging insufficient validation in the InterestGroups component to escalate privileges. The vulnerability is confirmed patched by Google (chromereleases advisory) with no public exploit code or active exploitation identified at time of analysis. CVSS 8.3 (High) reflects the severe impact of full sandbox escape, though the High attack complexity (requiring prior renderer compromise) limits immediate risk compared to single-stage remote code execution vulnerabilities.

Technical ContextAI

This vulnerability affects Google Chrome's InterestGroups component, part of the Privacy Sandbox initiative for interest-based advertising. The flaw stems from insufficient validation of data passed between Chrome's security boundaries. Chrome uses a multi-process architecture where renderer processes (handling web content) run in restricted sandboxes with limited system access. Successful exploitation requires an attacker to first compromise a renderer process through a separate vulnerability, then exploit the validation weakness to break sandbox containment. The Changed scope (S:C) in the CVSS vector indicates the vulnerability allows escape from the vulnerable component's security context. This represents a privilege escalation from sandboxed renderer to elevated Chrome process privileges, potentially enabling arbitrary code execution outside the sandbox with full user-level system access.

RemediationAI

Immediately update Google Chrome to version 148.0.7778.96 or later through Chrome's built-in update mechanism (Settings > About Chrome) or by downloading from google.com/chrome. Enterprise deployments should push updates via managed policy. Google's stable channel update advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html confirms the fix. If immediate patching is impossible, deploy compensating controls: disable JavaScript for untrusted sites via Chrome's site settings to prevent renderer compromise (reduces functionality significantly for modern web applications), enable Chrome's Enhanced Safe Browsing mode for additional exploit protection layers, or restrict Chrome usage to trusted domains only via enterprise policies. These mitigations reduce but do not eliminate risk since the vulnerability requires crafted HTML interaction. For air-gapped or highly controlled environments unable to update immediately, consider temporary use of alternative browsers until patching window opens, though this introduces workflow disruption.