What is the CVSS score of CVE-2026-7964?

CVE-2026-7964 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7964?

Yes, a patch is available for CVE-2026-7964. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7964

EUVD-2026-28031 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:43 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.2 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 4.2

DescriptionCVE.org

Insufficient validation of untrusted input in FileSystem in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient input validation in the FileSystem API in Google Chrome prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to perform arbitrary file read and write operations through a malicious HTML page. The vulnerability requires prior renderer compromise and user interaction with a crafted page, limiting its attack surface despite network-accessible vectors. Vendor has released a patched version.

Technical ContextAI

The vulnerability stems from improper validation of untrusted input (CWE-20) in Chrome's FileSystem implementation, likely the File System Access API or related sandbox-escaping file operations. The FileSystem module handles access to local file operations within the browser sandbox; insufficient input validation allows an attacker operating within a compromised renderer context to bypass intended restrictions on file access. The renderer process, while sandboxed from the main process, retains file-related capabilities that, when improperly validated, can be exploited to read and write arbitrary files on the user's system. This is a post-sandbox-escape vulnerability, meaning the attacker must first compromise the renderer process itself.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via automatic updates or manual download from https://www.google.com/chrome/update. Chrome's auto-update mechanism will deploy the patched version; users can verify installation via Chrome menu > About Google Chrome, which will show the current version and automatically check for updates. No workarounds are available for users running unpatched versions; however, disabling the File System Access API through enterprise policy (via chrome://policy) can mitigate the attack surface if configured by administrators. Note that disabling this API may break legitimate web applications relying on file system access. The primary mitigation is prompt patching, as the vulnerability requires prior renderer compromise, making prevention of the initial compromise more valuable than architectural workarounds.