What is the CVSS score of CVE-2026-7952?

CVE-2026-7952 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7952?

Yes, a patch is available for CVE-2026-7952. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7952

EUVD-2026-28007 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Authentication Bypass Chrome Google Red Hat Suse

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:42 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.2 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 4.2

DescriptionCVE.org

Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Chrome Extensions prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to bypass discretionary access controls via a crafted HTML page, potentially leading to unauthorized information disclosure or modification. The vulnerability requires user interaction and a pre-existing renderer compromise, limiting its practical exploitation scope. A vendor-released patch is available in Chrome 148.0.7778.96 and later.

Technical ContextAI

This vulnerability stems from CWE-693 (Protection Mechanism Failure), specifically inadequate policy enforcement within Chrome's extension sandboxing architecture. Chrome Extensions operate within a restricted security context, and this flaw allows an attacker who has already gained code execution in the renderer process (the browser's HTML/JavaScript execution environment) to circumvent the discretionary access controls that normally isolate extension permissions and capabilities. The renderer process is typically compromised through a separate renderer vulnerability; this CVE exploits insufficient policy validation after that initial breach. The attack surface involves crafted HTML payloads that trigger the policy bypass when processed by a compromised renderer.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome's auto-update mechanism will deliver this patch automatically on most systems; users can manually check for updates by navigating to Chrome Menu → About Google Chrome, which will force a check and apply any pending updates. No workarounds for pre-patch versions are available, as the vulnerability is embedded in the extension policy enforcement layer. Administrators managing Chrome via enterprise policies should verify that Chrome auto-updates are enabled and monitor deployment to ensure all instances are updated within 24-48 hours of patch availability. The patch addresses the underlying policy enforcement gap; no configuration changes or feature disabling is necessary post-patch.