What is the CVSS score of CVE-2026-7924?

CVE-2026-7924 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7924?

Yes, a patch is available for CVE-2026-7924. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7924

EUVD-2026-27951 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:41 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

6.5 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized memory use in Dawn (GPU abstraction layer) in Google Chrome prior to version 148.0.7778.96 allows remote attackers to read potentially sensitive information from process memory by opening a crafted HTML page. The vulnerability requires user interaction (clicking/viewing the malicious page) but no authentication, and has a high confidentiality impact. Chromium security team classified this as high severity; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Dawn is Google's GPU abstraction layer used in Chromium/Chrome to handle graphics rendering across different platforms. The vulnerability stems from CWE-457 (use of uninitialized variable), where a variable in Dawn's code path is read before being assigned a value. When processing crafted HTML containing specific graphics directives (likely WebGPU or WebGL content), an attacker can trigger this code path, causing the GPU driver interface to read and potentially leak uninitialized stack or heap memory from the renderer process. This uninitialized data may contain sensitive information such as cryptographic keys, passwords, or other secrets previously stored in memory. The CPE indicates all Chrome versions below 148.0.7778.96 are affected across all platforms and distributions.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Google Chrome auto-update is enabled by default on most deployments; users can manually check for updates via Settings > About Chrome, which triggers automatic download and installation (with restart required). For enterprise deployments, use Google's official Chrome Enterprise release channels and deployment tools to roll out the patched version. No workarounds are available for this memory disclosure vulnerability; patching is the only mitigation. The fix involves initializing all variables in the affected Dawn code path before use. Verify successful patch application by checking chrome://version and confirming the version number meets or exceeds 148.0.7778.96.