What is the CVSS score of CVE-2026-7948?

CVE-2026-7948 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7948?

CVE-2026-7948 is a local privilege escalation vulnerability in Google Chrome's Chromoting remote desktop component that could allow authenticated Windows users to gain system-level access through a…. A patch is available.

How to fix or mitigate CVE-2026-7948?

Within 24 hours: Identify all Windows systems with Google Chrome installed and document current versions via endpoint management tools. Within 7 days: Deploy Chrome version 148.0.7778.96 or later through your standard patching mechanism; prioritize systems with Chromoting enabled or used for remote support workflows. Within 30 days: Verify 100% deployment completion through endpoint telemetry and generate compliance report for audit records.

Google Chrome CVE-2026-7948

EUVD-2026-27999 HIGH

Race Condition (CWE-362)

2026-05-06 Chrome

Privilege Escalation Microsoft Race Condition Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:29 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 7.5

DescriptionCVE.org

Race in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome Chromoting (remote desktop component) allows authenticated Windows users to gain elevated system privileges through a race condition exploit triggered by a malicious file. Fixed in Chrome 148.0.7778.96. The vulnerability requires user interaction and high attack complexity (AC:H), limiting automated exploitation despite the 7.5 CVSS score. No public exploit identified at time of analysis, and not listed in CISA KEV.

Technical ContextAI

Chromoting is Google Chrome's built-in remote desktop protocol implementation, primarily used for Chrome Remote Desktop functionality on Windows platforms. The vulnerability stems from a race condition (CWE-362) - a time-of-check to time-of-use (TOCTOU) flaw where the component fails to properly synchronize access to shared resources during file operations. Race conditions occur when the outcome of an operation depends on the sequence or timing of uncontrollable events, creating a window where an attacker can manipulate system state between validation and use. In this case, the race window exists during processing of a specially crafted file, allowing a local user to escalate from standard user privileges to higher system privileges. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome versions prior to 148.0.7778.96 on Windows are affected.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately through the browser's built-in update mechanism (Settings → About Chrome) or via enterprise deployment tools. The vendor-released patch addresses the race condition in Chromoting file handling. For enterprise environments unable to patch immediately, implement compensating controls: disable Chrome Remote Desktop functionality via Group Policy (set RemoteAccessHostFirewallTraversal to disabled and RemoteAccessHostAllowRemoteAccessConnections to false) if this feature is not required for business operations - note this breaks remote desktop connectivity for affected users. Restrict local file execution permissions using Software Restriction Policies or AppLocker to prevent users from executing untrusted files in contexts where Chromoting processes them. Deploy application control to whitelist only authorized executables, though this may impact legitimate software installation workflows. Monitor Windows Event Logs for unusual privilege escalation patterns involving chrome.exe child processes. These workarounds significantly impact Chrome Remote Desktop users and should be considered temporary until patching is complete. Full advisory and patch details: http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.