What is the CVSS score of CVE-2026-7958?

CVE-2026-7958 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7958?

Yes, a patch is available for CVE-2026-7958. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7958

EUVD-2026-28019 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-06 Chrome

XSS Google Red Hat Suse Chrome

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:43 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Uncontrolled XSS vulnerability in Google Chrome's ServiceWorker implementation prior to version 148.0.7778.96 allows attackers to inject arbitrary scripts or HTML into web pages when users install a malicious Chrome extension, bypassing same-origin policy protections. The vulnerability requires user interaction (extension installation) but can be exploited remotely with low attack complexity. CVSS score of 5.4 reflects medium severity; no active exploitation has been publicly reported.

Technical ContextAI

The vulnerability exists in Chrome's ServiceWorker API, a web platform feature that allows extensions and websites to run background scripts independently of the page lifecycle. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates insufficient input validation or output encoding when ServiceWorkers handle data from malicious extensions. The weakness permits a compromised or malicious extension to manipulate the script execution context, allowing injection of arbitrary JavaScript or HTML that executes with the privileges of the affected origin. ServiceWorkers are designed to intercept and modify network requests and responses, making them an attractive attack surface for extensions seeking to bypass content security policies.

RemediationAI

Users and organizations must upgrade Google Chrome to version 148.0.7778.96 or later, available immediately from the stable channel via Google's automatic update mechanism or manual download at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. No workarounds exist for this vulnerability; patching is the only remediation. Organizations managing Chrome via enterprise deployment policies should use Google Admin Console or group policies to force update to version 148.0.7778.96 or higher. Additionally, implement extension management policies to restrict which extensions can be installed - disable user installation of extensions from outside an authorized list, or block extensions with suspicious permissions (particularly those requesting broad host permissions or manifest v2 content scripts that interact with ServiceWorkers). While this does not prevent installation of legitimate extensions, it reduces the attack surface by preventing users from casually installing third-party extensions discovered via social engineering.