What is the CVSS score of CVE-2026-7944?

CVE-2026-7944 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7944?

Yes, a patch is available for CVE-2026-7944. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7944

EUVD-2026-27991 LOW

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:42 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

3.1 (LOW)

CVE Published

May 06, 2026 - 18:12 nvd

LOW 3.1

DescriptionCVE.org

Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient validation of untrusted input in the Persistent Cache of Google Chrome prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to bypass site isolation protections via a specially crafted HTML page, enabling unauthorized disclosure of sensitive information from other sites. The vulnerability requires prior renderer compromise and user interaction, limiting real-world exploitability despite network-accessible attack vector. No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability exists in Google Chrome's Persistent Cache component, which is responsible for storing and retrieving cached data across browser sessions. Chrome's renderer process isolation (site isolation) is a critical security boundary designed to prevent cross-site data leakage and CSRF attacks by isolating renderers per site or principal. The flaw stems from CWE-20 (Improper Input Validation), where untrusted cache entries are not properly validated before being used in contexts that could reveal data across site boundaries. An attacker who has already achieved code execution in the renderer process can craft malicious HTML and cache entries to trick the browser into serving sensitive data from other origins. This is a post-compromise scenario rather than an initial access vector.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. This is the vendor-released patch that fixes the Persistent Cache validation flaw. Users can verify their current version by navigating to chrome://version/ and should enable automatic updates to ensure they receive this and future security patches. No workarounds are available for users who cannot immediately patch, though the vulnerability's requirement for prior renderer compromise significantly reduces practical risk in typical consumer and enterprise environments where renderer-level attacks are rare. For enterprise environments, consider enforcing Chrome updates via group policy or mobile device management to ensure uniform patching.