What is the CVSS score of CVE-2026-7920?

CVE-2026-7920 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7920?

Google Chrome versions prior to 148.0.7778.96 contain a sandbox escape vulnerability in the Skia graphics library that allows attackers with renderer process control to escalate privileges and…. A patch is available.

How to fix or mitigate CVE-2026-7920?

Within 24 hours: Inventory Chrome deployment scope and confirm current version across all endpoints. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all affected systems via your patch management system; prioritize user-facing devices and systems handling sensitive data. Within 30 days: Validate 100% deployment completion and audit Chrome auto-update settings to prevent future version lag.

Google Chrome CVE-2026-7920

EUVD-2026-27943 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:26 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.96 allows remote attackers who have already compromised the renderer process to break out of Chrome's security sandbox through a use-after-free vulnerability in the Skia graphics library. Exploitation requires user interaction with a malicious HTML page and successful prior renderer compromise, representing a second-stage attack rather than initial access. No active exploitation confirmed (not in CISA KEV), though the vulnerability's sandbox escape capability makes it valuable for targeted attack chains.

Technical ContextAI

Skia is Chrome's 2D graphics rendering engine responsible for drawing web page elements, canvas operations, and UI components. The CWE-416 use-after-free occurs when code attempts to access memory after it has been freed, typically due to incorrect object lifetime management or race conditions during asynchronous operations. In Skia's context, this often involves graphics object destruction while references remain active during rendering operations. The CVSS scope change (S:C) reflects the vulnerability's ability to escape Chrome's multi-process sandbox architecture, where renderer processes normally operate with restricted privileges isolated from the underlying operating system. The 'High' Chromium security severity reflects the sandbox escape capability, as renderer compromise alone is typically rated lower without the privilege escalation component.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via the built-in auto-update mechanism (Settings → About Chrome) or by downloading from https://www.google.com/chrome/. The vendor-released patch is confirmed available per the stable channel update announcement at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome typically auto-updates within 24-48 hours of release, but manual update verification is recommended for enterprise environments. For organizations unable to patch immediately, compensating controls include: restricting Chrome usage to trusted sites only via enterprise policy URL allowlists (ChromeEnterpriseAllowlist), though this significantly limits browser functionality and user productivity; deploying browser isolation solutions that render untrusted content in remote containers, adding another sandbox layer but introducing latency and infrastructure costs; or temporarily switching to alternative browsers until patching is complete, which may disrupt workflows dependent on Chrome-specific features or extensions. None of these workarounds provide complete protection since the vulnerability exists in the installed Chrome binary.