What is the CVSS score of CVE-2026-7927?

CVE-2026-7927 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7927?

Google Chrome versions before 148.0.7778.96 contain a remote code execution vulnerability in the JavaScript runtime that allows attackers to execute arbitrary code on user systems through malicious…. A patch is available.

How to fix or mitigate CVE-2026-7927?

Within 24 hours: Identify all Chrome deployments across the organization using asset management tools and create an urgent patch deployment queue for version 148.0.7778.96 or later. Within 7 days: Deploy patches to all Chrome installations via your endpoint management platform (e.g., SCCM, Intune, MDM) and verify 95%+ compliance through automated reporting. Within 30 days: Achieve 100% patch compliance, audit any systems that remain unpatched, and document remediation or acceptable use exceptions with CISO sign-off.

Google Chrome CVE-2026-7927

EUVD-2026-27957 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-06 Chrome

Memory Corruption Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:27 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.96 occurs when attackers exploit a type confusion vulnerability in the JavaScript runtime through malicious web pages. The vulnerability requires only that users visit a crafted HTML page, making it highly accessible for social engineering attacks. No active exploitation confirmed by CISA KEV at time of analysis, though Google has released patches addressing this high-severity memory corruption flaw with confirmed public disclosure through Chromium issue tracker.

Technical ContextAI

This vulnerability stems from CWE-843 (Type Confusion), a memory corruption class where the Chrome JavaScript runtime incorrectly handles object type assumptions during execution. Type confusion occurs when code processes data using an incompatible type handler, allowing attackers to manipulate memory layouts and bypass type safety checks. In Chrome's V8 JavaScript engine or related runtime components, this can lead to arbitrary read/write primitives within the sandboxed renderer process. The CPE identifier cpe:2.3:a:google:chrome confirms this affects the Google Chrome browser application across all supported platforms (Windows, macOS, Linux, ChromeOS). The vulnerability resides in core runtime components responsible for JavaScript execution, making it a fundamental weakness in the browser's scripting engine rather than an isolated feature.

RemediationAI

Update Google Chrome immediately to version 148.0.7778.96 or later through the browser's built-in update mechanism (chrome://settings/help) or by downloading from google.com/chrome. Google's stable channel update announced at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html confirms patch availability across all desktop platforms with gradual rollout over coming days/weeks. Enterprise administrators should deploy the update through managed update channels (Google Update for Windows, MDM policies for macOS/ChromeOS) and verify deployment using chrome://policy verification. For Chromium-based third-party browsers, consult respective vendor security advisories for patched versions incorporating the upstream fix from Chromium issue 502830119. If immediate patching is not feasible, implement compensating controls: restrict web browsing to trusted sites only through DNS filtering or web proxy policies, deploy browser isolation technologies (remote browser isolation/application isolation) to contain potential exploitation, disable JavaScript for untrusted sites using browser extensions like uMatrix or NoScript (significant functionality impact on modern web applications), and enforce strict Content Security Policy headers on organizational web properties to limit attacker-controlled script execution. These mitigations significantly degrade user experience and web application functionality, making rapid patching the only sustainable remediation strategy.