What is the CVSS score of CVE-2026-7940?

CVE-2026-7940 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7940?

Chrome versions prior to 148.0.7778.96 contain a use-after-free vulnerability in the V8 engine that allows attackers to execute arbitrary code within the browser sandbox if users install a malicious…. A patch is available.

How to fix or mitigate CVE-2026-7940?

Within 24 hours: Identify Chrome deployment method (managed/unmanaged) and confirm current version baseline across the organization. Within 7 days: Deploy Chrome 148.0.7778.96 or later through your update mechanism (Windows Update, MDM, or manual distribution) to all systems. Disable side-loading of unsigned extensions via Group Policy (ExtensionInstallBlocklist='*' for unmanaged users) to prevent malicious extension installation. Within 30 days: Conduct user awareness training on extension security risks and audit installed extensions organization-wide using Chrome Enterprise policies for compliance verification.

Google Chrome CVE-2026-7940

EUVD-2026-27983 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.7 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:29 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in Chrome's V8 JavaScript engine enables remote code execution inside the sandbox when users install a malicious extension. Google Chrome versions prior to 148.0.7778.96 are vulnerable to arbitrary code execution through specially crafted Chrome Extensions exploiting memory corruption in V8. CVSS rates this 8.8 (High) with network attack vector requiring user interaction. Vendor-released patch available in Chrome 148.0.7778.96 per Google's May 2026 stable channel update. EPSS and KEV data not provided; exploitation requires social engineering to install malicious extension, limiting automated exploitation scenarios.

Technical ContextAI

V8 is Google's open-source JavaScript and WebAssembly engine used in Chrome and Chromium browsers. This vulnerability is a use-after-free condition (CWE-416), a class of memory corruption bug where code continues to use a memory pointer after the referenced object has been deallocated. In V8's context, this typically occurs during JavaScript execution when garbage collection prematurely frees objects still referenced by running code. The malicious extension context is critical: Chrome's extension APIs provide elevated privileges to interact with browser internals and V8 engine components. While code execution occurs within Chrome's sandbox architecture (limiting system-level access), the attacker gains arbitrary code execution within the renderer process, potentially enabling sandbox escape when chained with other vulnerabilities. The CPE string cpe:2.3:a:google:chrome identifies all Google Chrome browser installations on any platform prior to the fixed version.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.96, available via Google's May 2026 stable channel update at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Users should update immediately through Chrome's built-in updater (Settings → About Chrome) or enterprise deployment tools. For organizations unable to patch immediately, implement compensating controls: restrict extension installation via enterprise policy ExtensionInstallBlocklist to block all extensions except approved allowlist, mitigating the attack vector entirely but impacting user productivity if extensions are workflow-critical; disable Developer Mode via DeveloperToolsAvailability policy to prevent sideloading of unpacked extensions, though this doesn't prevent Web Store-distributed malicious extensions; deploy Chrome Enterprise with ExtensionInstallSources policy limiting installations to corporate-controlled stores only. Monitor Chrome extension installation logs via chrome://policy and endpoint detection tools. Note these controls require Chrome Enterprise licensing and may disrupt legitimate extension-dependent workflows. No workaround eliminates vulnerability in affected V8 code itself.