What is the CVSS score of CVE-2026-7919?

CVE-2026-7919 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7919?

Chrome versions before 148.0.7778.96 contain a sandbox escape vulnerability that allows attackers with renderer process access to execute arbitrary system commands with full privileges.. A patch is available.

How to fix or mitigate CVE-2026-7919?

Within 24 hours: Inventory all Chrome deployments and identify systems running versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later across all affected endpoints through your standard patch management process; prioritize devices with elevated risk profiles (developers, researchers, or high-value targets). Within 30 days: Verify 100% deployment compliance through endpoint management tools and audit logs.

Google Chrome CVE-2026-7919

EUVD-2026-27941 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:26 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Aura in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.96 enables remote attackers who have already compromised the renderer process to break out of Chrome's security sandbox through a use-after-free vulnerability in the Aura UI framework. The attack requires user interaction with a malicious webpage and presents high attack complexity, but successfully chains renderer compromise with sandbox escape to achieve full system impact. No active exploitation confirmed (not in CISA KEV), though this vulnerability class is frequently targeted given Chrome's wide deployment and the high value of sandbox escapes.

Technical ContextAI

The vulnerability exists in Aura, Google Chrome's cross-platform UI framework used for window management and compositing on Windows and Linux. A use-after-free (CWE-416) occurs when code attempts to access memory after it has been freed, creating a window where an attacker can manipulate the freed memory region before reuse. In Chrome's multi-process architecture, the renderer process handles untrusted web content in a restricted sandbox, while privileged operations occur in the browser process. This vulnerability allows an attacker who has already achieved arbitrary code execution within the sandboxed renderer (through a separate exploit) to escape that sandbox by triggering the use-after-free in Aura's UI handling code, potentially gaining browser process privileges. The CVSS Scope:Changed metric indicates the vulnerability crosses trust boundaries-specifically from the sandboxed renderer to the privileged browser context.

RemediationAI

Immediately upgrade Google Chrome to version 148.0.7778.96 or later through Chrome's built-in updater (Settings → About Chrome) or via enterprise deployment tools. The patch addresses the use-after-free condition in Aura's memory management. Chrome typically auto-updates within 24-48 hours of release, but manual update verification is recommended for critical environments. Google's stable channel update announcement at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html provides official release details. For environments requiring delayed patching, implement defense-in-depth through enhanced user training on phishing/malicious sites, browser isolation technologies (Chromium-based enterprise browser isolation or virtual desktop infrastructure), network-layer filtering of known malicious domains, and endpoint detection with behavioral monitoring for sandbox escape attempts. Note that site isolation (enabled by default in modern Chrome) provides partial mitigation by limiting renderer compromise scope, but does not prevent exploitation if an attacker gains renderer process control. These compensating controls significantly reduce usability and performance compared to patching.