What is the CVSS score of CVE-2026-7918?

CVE-2026-7918 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7918?

Google Chrome versions prior to 148.0.7778.96 contain a sandbox escape vulnerability in the GPU component that allows attackers who have compromised the renderer process to gain full system access.. A patch is available.

How to fix or mitigate CVE-2026-7918?

Within 24 hours: Identify all Chrome deployments and document current versions via endpoint management systems. Within 7 days: Deploy Chrome 148.0.7778.96 or later via organization's patch management process to all endpoints; prioritize systems accessing high-risk websites and those with sensitive data access. Within 30 days: Verify 100% compliance with minimum version 148.0.7778.96 through automated compliance scanning and audit logs.

Google Chrome CVE-2026-7918

EUVD-2026-27939 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:25 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's GPU component prior to version 148.0.7778.96 allows remote attackers who have already compromised the renderer process to break out of Chrome's security sandbox via a use-after-free memory corruption vulnerability triggered by a malicious web page. This represents a critical second-stage attack where initial renderer compromise is chained with GPU exploitation to achieve full system access. Vendor-released patch available in Chrome 148.0.7778.96. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.

Technical ContextAI

This vulnerability affects Google Chrome's GPU process component, which handles hardware-accelerated graphics rendering isolated from the main browser process. The root cause is a use-after-free condition (CWE-416), occurring when GPU code attempts to access memory that has already been deallocated. Chrome's multi-process architecture employs sandbox isolation to contain compromised renderer processes, but GPU process vulnerabilities can bypass this critical security boundary. The CVSS Changed Scope (S:C) metric reflects this sandbox escape capability, where impact extends beyond the vulnerable component's security context. GPU-related UAF bugs typically arise from complex object lifecycle management in graphics API implementations (WebGL, Canvas, video decoding) where asynchronous operations and shared state create race conditions or improper cleanup sequencing.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via the browser's built-in update mechanism (Settings > About Chrome) or enterprise deployment tools like Google Update for Windows or managed deployment packages for macOS/Linux. For environments unable to patch immediately, implement defense-in-depth controls: enforce site isolation via chrome://flags/#site-isolation-trial-opt-out set to Disabled to strengthen renderer process boundaries, disable hardware acceleration (chrome://settings/?search=hardware) as temporary mitigation though this significantly degrades graphics performance and user experience, and restrict user access to untrusted websites through DNS filtering or web proxy policies. Enterprise administrators should verify auto-update policies are enabled and monitor Chrome version compliance via endpoint management tools. Full advisory and patch details at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Note that disabling hardware acceleration impacts video playback, WebGL applications, and overall browser responsiveness - acceptable for short-term risk reduction but not sustainable long-term solution.