What is the CVSS score of CVE-2026-7955?

CVE-2026-7955 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7955?

Yes, a patch is available for CVE-2026-7955. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7955

EUVD-2026-28013 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:43 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 5.3

DescriptionCVE.org

Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory use in the GPU component of Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive information from process memory through a malicious HTML page. The vulnerability requires renderer process compromise as a precondition and user interaction to trigger, but once achieved, enables confidentiality breach with no code execution or denial of service impact. Vendor-released patch available in Chrome 148.0.7778.96.

Technical ContextAI

The vulnerability exists in Chrome's GPU handling subsystem and stems from CWE-457 (Use of Uninitialized Variable). GPU memory operations in Chrome's renderer process may fail to initialize buffers or variables before use, allowing uninitialized data containing sensitive information from other processes or kernel memory to be read. The attack vector requires prior compromise of the renderer process (a sandbox boundary crossing), after which an attacker can craft specific HTML/WebGL calls to trigger the uninitialized read. The GPU component is used for hardware-accelerated rendering and WebGL execution, making it a sensitive attack surface when renderer process integrity is lost.

RemediationAI

Users should upgrade Google Chrome to version 148.0.7778.96 or later immediately. The patch is available through Chrome's automatic update mechanism (Settings > About > Help) or direct download from the Chrome website. Chrome typically auto-updates within hours of a stable release, but users can manually trigger the update check. No workarounds are available for this memory disclosure vulnerability - patching is the only mitigation. Organizations using Chrome in high-security contexts should verify update completion via 'chrome://version' to confirm the running version is 148.0.7778.96 or later. Refer to Google's stable channel update announcement at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/496441232 for detailed technical information.