What is the CVSS score of CVE-2026-7968?

CVE-2026-7968 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7968?

Yes, a patch is available for CVE-2026-7968. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7968

EUVD-2026-28040 LOW

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:43 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

3.1 (LOW)

CVE Published

May 06, 2026 - 18:12 nvd

LOW 3.1

DescriptionCVE.org

Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient validation of untrusted input in CORS handling in Google Chrome prior to version 148.0.7778.96 allows a remote attacker who has compromised the renderer process to bypass the same-origin policy via a crafted HTML page, potentially leading to unauthorized information disclosure. The vulnerability requires renderer process compromise and user interaction, resulting in a CVSS score of 3.1 (low severity). No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the Cross-Origin Resource Sharing (CORS) implementation within Chrome's renderer process. CORS is a security mechanism that controls how web pages from one origin can access resources from another origin. The flaw stems from insufficient validation (CWE-20: Improper Input Validation) of untrusted input when processing CORS policy checks. This allows an attacker who has already compromised the renderer process to craft malicious HTML that bypasses origin policy enforcement. The affected CPE is cpe:2.3:a:google:chrome, indicating the vulnerability affects the Chrome browser across platforms where this component is present.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, which contains the vendor-released patch. Users can verify their current version by navigating to chrome://version or chrome://help, where Chrome will automatically check for updates and display the installed version. No workarounds for this vulnerability have been identified; patching is the primary remediation. Organizations can enforce automatic updates via Chrome management policies (chrome://policy on managed devices) to ensure timely deployment across their user base. The patch addresses the insufficient input validation in CORS handling, restoring proper same-origin policy enforcement in the renderer process. Refer to the Chrome stable channel update announcement at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and Chromium issue tracker at https://issues.chromium.org/issues/497432281 for additional technical details.