What is the CVSS score of CVE-2026-7936?

CVE-2026-7936 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7936?

Yes, a patch is available for CVE-2026-7936. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7936

EUVD-2026-27975 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-06 Chrome

Google Information Disclosure Buffer Overflow Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:41 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 4.3

DescriptionCVE.org

Object lifecycle issue in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.

Technical ContextAI

The vulnerability exists in V8, Google's open-source JavaScript engine embedded in Chrome, and stems from an object lifecycle management issue (CWE-125: Out-of-bounds Read). V8 manages memory for JavaScript objects through a complex garbage collection and reference counting system. The flaw allows an attacker to craft malicious HTML/JavaScript that triggers improper object lifecycle handling, resulting in memory access beyond allocated buffer boundaries. This permits reading adjacent memory contents that may contain sensitive data. The vulnerability is specific to Chrome's rendering engine and JavaScript execution layer, not a general V8 library issue, as indicated by the Chrome-specific advisory and Chromium issue tracker reference.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Users can verify their Chrome version by navigating to chrome://settings/help, which will automatically check for and install available updates. Chrome typically auto-updates on a schedule (weekly for most users), but manual installation via chrome://settings/help or reinstallation from google.com/chrome ensures immediate patching. No workarounds exist for this vulnerability since it requires browser code changes; however, users who cannot immediately patch should avoid opening links from untrusted sources and consider disabling JavaScript in high-risk scenarios via browser extensions (such as NoScript), though this substantially impacts web functionality. Organizations can force Chrome updates via Group Policy (Windows) or Mobile Device Management (macOS/Linux) to ensure rapid patch deployment across their user base. The vendor advisory is available at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.