What is the CVSS score of CVE-2026-7938?

CVE-2026-7938 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7938?

Google Chrome versions before 148.0.7778.96 contain a critical remote code execution vulnerability in the CSS rendering engine that allows attackers to execute arbitrary code within the browser…. A patch is available.

How to fix or mitigate CVE-2026-7938?

Within 24 hours: Identify all Chrome deployments across the organization and communicate mandatory update requirement to all users. Within 7 days: Deploy Chrome 148.0.7778.96 or later through your managed update mechanism (MDM, SCCM, or native Chrome auto-update); verify deployment completion for 95%+ of endpoints. Within 30 days: Conduct compliance audit to confirm 100% of Chrome installations are patched and establish automated version enforcement to prevent downgrades or delays on future critical updates.

Google Chrome CVE-2026-7938

EUVD-2026-27979 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:29 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome before 148.0.7778.96 allows unauthenticated attackers to execute arbitrary code within the Chrome sandbox by exploiting a use-after-free vulnerability in the CSS rendering engine through a malicious webpage. Requires victim interaction (visiting attacker-controlled page) but needs no authentication. Vendor-released patch available as Chrome 148.0.7778.96. EPSS score not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis, though browser vulnerabilities are high-value targets.

Technical ContextAI

This is a use-after-free vulnerability (CWE-416) in Chrome's Cascading Style Sheets (CSS) parsing and rendering implementation. Use-after-free conditions occur when a program continues to use a memory pointer after the memory has been freed, creating a dangling pointer that can be exploited to corrupt memory and redirect program execution. In browser engines, CSS processing involves complex object lifecycle management for DOM elements, style rules, and layout calculations. The vulnerability affects Chrome's Blink rendering engine component responsible for CSS processing. According to CPE data (cpe:2.3:a:google:chrome), this impacts Google Chrome browser across all platforms prior to the patched version. The memory corruption class enables attackers to overwrite freed memory with controlled data, potentially achieving arbitrary code execution within the renderer process sandbox.

RemediationAI

Immediate action: Update Google Chrome to version 148.0.7778.96 or later via built-in auto-update (chrome://settings/help) or manual download from google.com/chrome. Chrome's auto-update typically deploys patches within 24-48 hours for active installations. Verify successful update by checking chrome://settings/about shows version ≥148.0.7778.96. For enterprise environments using managed deployments, push updated Chrome MSI/PKG packages through existing software distribution channels per organizational change control. No workarounds exist for use-after-free vulnerabilities-patching is mandatory. Organizations unable to immediately patch should implement defense-in-depth: restrict web browsing to trusted sites via web filtering/proxy, enable Enhanced Safe Browsing in Chrome settings for real-time malicious site detection (trade-off: increased telemetry to Google), deploy browser isolation solutions (Chromium sandbox already provides process isolation but additional network-level isolation adds defense), and prioritize patching user-facing systems first. Reference stable channel update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for release notes.