What is the CVSS score of CVE-2026-7930?

CVE-2026-7930 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7930?

Google Chrome versions before 148.0.7778.96 contain a privilege escalation vulnerability (CVSS 8.8) that allows attackers to gain elevated system access through malicious web pages, requiring only…. A patch is available.

How to fix or mitigate CVE-2026-7930?

Within 24 hours: Identify all Chrome installations prior to version 148.0.7778.96 using endpoint management tools and issue urgent patch notification to users. Within 7 days: Deploy Chrome 148.0.7778.96 or later via automatic updates or managed deployment; verify 100% compliance. Within 30 days: Audit logs for suspicious Chrome-based access patterns and confirm full remediation across all endpoints.

Google Chrome CVE-2026-7930

EUVD-2026-27963 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Privilege Escalation Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:28 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in Cookies in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome versions prior to 148.0.7778.96 enables remote attackers to elevate privileges through malicious HTML pages exploiting improper cookie validation. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but no authentication, making it viable for phishing or watering-hole attacks. CVSS score of 8.8 indicates high severity across confidentiality, integrity, and availability. Vendor-released patch available in Chrome 148.0.7778.96 per Google's stable channel update. EPSS and KEV data not provided; exploitation status unknown at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-20 (Improper Input Validation) in Chrome's cookie handling mechanism. The browser fails to properly sanitize or validate untrusted input when processing cookies, allowing specially crafted values within HTML pages to trigger privilege escalation. Modern browsers implement complex cookie policies including SameSite attributes, secure flags, and domain restrictions; insufficient validation in any of these parsing routines can enable attackers to bypass security boundaries. The CPE identifier cpe:2.3:a:google:chrome indicates the Chromium browser engine is affected. The Chromium bug tracker reference (issues/434825208) suggests this was discovered through Google's Vulnerability Reward Program or internal security review, given the Medium security severity rating assigned by the Chromium team.

RemediationAI

Upgrade immediately to Google Chrome version 148.0.7778.96 or later, as confirmed by the stable channel update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism (enabled by default) delivers this patch automatically; verify installation by navigating to chrome://settings/help. For enterprise environments using managed deployments, push version 148.0.7778.96 through group policy or mobile device management. If immediate patching is not feasible, implement compensating controls: disable automatic cookie acceptance and configure Chrome to prompt for cookies on all sites via chrome://settings/cookies (note: this severely impacts usability and breaks many web applications). Block access to untrusted sites through DNS filtering or web proxies. Deploy browser isolation solutions to contain potential compromise. These workarounds provide minimal protection and should not replace patching.