What is the CVSS score of CVE-2026-7959?

CVE-2026-7959 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7959?

Yes, a patch is available for CVE-2026-7959. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7959

EUVD-2026-28021 LOW

Improper Access Control (CWE-284)

2026-05-06 Chrome

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:43 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

3.1 (LOW)

CVE Published

May 06, 2026 - 18:12 nvd

LOW 3.1

DescriptionCVE.org

Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Bypass of Chrome's site isolation security feature in versions prior to 148.0.7778.96 allows a remote attacker with a compromised renderer process to access cross-site data via a crafted HTML page. The vulnerability requires renderer process compromise as a precondition, limiting real-world risk despite the criticality of bypassing site isolation. Vendor-released patch: version 148.0.7778.96 and later.

Technical ContextAI

Site isolation is Chrome's core architectural defense that runs each website in a separate renderer process, preventing cross-site data theft even if a single renderer is compromised. This CVE affects the Navigation subsystem's implementation, allowing inappropriate handling of navigation events or frame interactions that permits a compromised renderer to escape the isolation boundary and access data from other sites. The vulnerability is classified as an authentication bypass (CWE not provided by vendor), indicating the attack circumvents the isolation mechanism's access controls rather than exploiting memory corruption. The attack surface requires the attacker to first compromise the renderer process, typically through a separate vulnerability or malware, then leverage this navigation flaw to escalate the compromise across site boundaries.

RemediationAI

Immediate remediation is to upgrade Google Chrome to version 148.0.7778.96 or later via the automatic update mechanism or manual installation from https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Users can verify their current version via chrome://version and enable automatic updates in chrome://settings/help. No workarounds exist to mitigate site isolation bypass short of disabling JavaScript or avoiding untrusted websites, both of which degrade functionality. Organizations should prioritize patching within 1-2 weeks of release. Note that this patch addresses only the navigation vulnerability; users must maintain defenses against the initial renderer compromise vulnerabilities that serve as the exploitation prerequisite.