What is the CVSS score of CVE-2026-7931?

CVE-2026-7931 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-7931?

Yes, a patch is available for CVE-2026-7931. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-7931

EUVD-2026-27965 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Apple Google Information Disclosure Red Hat Suse Chrome

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:41 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 5.4

DescriptionCVE.org

Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome on iOS prior to version 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the browser interface. The vulnerability stems from insufficient validation of untrusted input and has a CVSS score of 5.4 (medium severity). Exploitation requires user interaction with a malicious webpage but can result in information disclosure and denial of service on affected iOS devices.

Technical ContextAI

The vulnerability exists in the input validation layer of Chrome's iOS implementation, specifically in how the browser handles and renders HTML content. CWE-20 (Improper Input Validation) indicates that the browser fails to properly sanitize or validate user-supplied input before using it to construct UI elements. This allows an attacker to craft malicious HTML that exploits the rendering engine to display fake interface elements-such as address bars, security indicators, or dialog boxes-that appear legitimate to the user. The issue is specific to iOS because Chrome on iOS uses Apple's WebKit rendering engine, which may have different rendering behavior than the Chromium engine used on Android and desktop platforms.

RemediationAI

Update Google Chrome on iOS to version 148.0.7778.96 or later through the Apple App Store. Users can verify their Chrome version by opening the app, navigating to Settings > About Chrome, and checking the displayed version number. Automatic updates are enabled by default in the App Store, so most users will receive the patch within days of release. No workarounds are available for this client-side vulnerability; the only mitigation is to run a patched version. In the interim, users should avoid clicking links to untrusted websites and disable JavaScript in Chrome settings if they encounter suspicious pages, though this significantly impacts browsing functionality. Organizations managing iOS devices through Mobile Device Management (MDM) can enforce minimum Chrome version requirements, ensuring devices do not fall below 148.0.7778.96. Additional mitigation information is available in the Chrome releases blog (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html) and the Chromium issue tracker (https://issues.chromium.org/issues/474338157).