What is the CVSS score of CVE-2026-7957?

CVE-2026-7957 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7957?

Google Chrome versions prior to 148.0.7778.96 on macOS and iOS contain a remote code execution vulnerability in the Media component that could allow attackers to execute arbitrary code within the…. A patch is available.

How to fix or mitigate CVE-2026-7957?

Within 24 hours: Inventory all macOS and iOS devices running Chrome versions prior to 148.0.7778.96 and communicate patching urgency to affected users. Within 7 days: Deploy Chrome 148.0.7778.96 or later across all macOS and iOS endpoints using Mobile Device Management (MDM) or enterprise update mechanisms; verify deployment completion. Within 30 days: Audit Chrome version compliance across the organization and establish automatic update policies to prevent future exposure to known vulnerabilities.

Google Chrome CVE-2026-7957

EUVD-2026-28017 HIGH

Out-of-bounds Write (CWE-787)

2026-05-06 Chrome

Buffer Overflow Memory Corruption RCE Apple Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:30 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's Media component on macOS and iOS versions prior to 148.0.7778.96 allows attackers to execute arbitrary code within the browser sandbox by exploiting an out-of-bounds write vulnerability. Attack requires the compromised renderer process prerequisite plus user interaction with a malicious HTML page. CVSS rates this 8.8 (High) due to network attack vector and no authentication required, though exploitation remains constrained by the sandbox boundary and requires initial renderer compromise. Vendor-released patch available in Chrome 148.0.7778.96. No active exploitation (CISA KEV) or public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability stems from an out-of-bounds write (CWE-787) in Chrome's Media processing subsystem, specifically affecting macOS and iOS platforms. Out-of-bounds write vulnerabilities occur when software writes data beyond allocated memory boundaries, enabling attackers to corrupt memory structures, overwrite function pointers, or inject executable code. The CPE identifier cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms Google Chrome as the affected product. The Media component handles video/audio playback, codec operations, and multimedia stream processing - complex attack surface areas that parse untrusted external data. The platform-specific nature (Mac/iOS only) suggests the flaw exists in platform-dependent media framework integration code, potentially involving AVFoundation or Core Media APIs rather than cross-platform Chromium media code.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later on all macOS and iOS devices, as confirmed by Google's stable channel update advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deploy this patch automatically for most installations within 24-48 hours. Enterprise deployments using managed Chrome should force-update via policy or MSI distribution. No effective workarounds exist due to the vulnerability's location in core Media processing - disabling specific media codecs is not feasible without breaking essential browser functionality. For environments unable to patch immediately, compensating controls include restricting Chrome usage to trusted websites only via URL allowlists, deploying browser isolation technologies to contain potential renderer compromises, and enforcing strict Content Security Policy headers to mitigate malicious HTML delivery. Note these compensations provide limited protection given the user-interaction prerequisite inherently involves visiting attacker-controlled pages.