What is the CVSS score of CVE-2026-7966?

CVE-2026-7966 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7966?

Yes, a patch is available for CVE-2026-7966. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7966

EUVD-2026-28035 LOW

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:43 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

3.1 (LOW)

CVE Published

May 06, 2026 - 18:12 nvd

LOW 3.1

DescriptionCVE.org

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient input validation in SiteIsolation allows remote attackers who have compromised the Chrome renderer process to bypass site isolation protections via a crafted HTML page, potentially leaking sensitive data across site boundaries. The vulnerability affects Chrome versions prior to 148.0.7778.96 and requires prior renderer compromise and user interaction, resulting in low real-world exploitation probability despite the authentication bypass classification.

Technical ContextAI

SiteIsolation is Chrome's security architecture that isolates renderer processes by site to prevent cross-site data leaks. The vulnerability stems from CWE-20 (Improper Input Validation) in the SiteIsolation validation logic. An attacker who has already achieved renderer process compromise (through a separate vulnerability) can craft a malicious HTML page that fails proper validation checks, allowing the attacker to bypass the site isolation boundary that normally prevents one compromised renderer from accessing data belonging to other sites. This requires the attacker to already control the renderer process, making this a post-exploitation technique rather than an initial attack vector.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, which includes the input validation fix for SiteIsolation. Users can enable automatic updates or manually check via Menu > Help > About Google Chrome, which will trigger automatic update checks. As a compensating control, organizations can restrict users from visiting untrusted websites or disable JavaScript execution in lower-trust browser contexts, though these mitigations are impractical for general Chrome users. The primary mitigation remains timely patching, as SiteIsolation bypass protection cannot be meaningfully hardened through configuration changes. Refer to Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and the Chromium issue tracker at https://issues.chromium.org/issues/497341787 for technical details.