What is the CVSS score of CVE-2026-7973?

CVE-2026-7973 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7973?

Chrome's WebGPU graphics API contains a critical integer overflow flaw that allows attackers to escape the browser sandbox on Windows systems when users visit malicious websites, potentially enabling…. A patch is available.

How to fix or mitigate CVE-2026-7973?

Within 24 hours: Inventory all Chrome deployments on Windows systems and verify current version numbers. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all affected Windows devices using your standard patch management process; enable automatic updates if not currently enabled. Within 30 days: Confirm patch deployment completion across 100% of Windows Chrome installations and validate no systems remain on versions prior to 148.0.7778.96.

Google Chrome CVE-2026-7973

EUVD-2026-28049 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-06 Chrome

Microsoft Google Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Dawn in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Integer overflow in Chrome's Dawn graphics API (WebGPU) enables sandbox escape on Windows systems when users visit attacker-controlled web pages. Affects all Chrome versions prior to 148.0.7778.96 on Windows platforms. Vendor-released patch available in Chrome 148.0.7778.96 (confirmed by Google Stable Channel release). CVSS 8.8 reflects high impact but requires user interaction. No public exploit code or CISA KEV listing identified at time of analysis, indicating targeted or proof-of-concept stage exploitation risk rather than widespread active exploitation.

Technical ContextAI

Dawn is Google's open-source implementation of the WebGPU graphics API, providing low-level GPU access to web applications through Chrome. The vulnerability stems from an integer overflow (CWE-472) in Dawn's processing logic on Windows platforms. Integer overflows occur when arithmetic operations produce results exceeding the maximum value a data type can hold, causing wraparound to small values. In graphics APIs handling buffer sizes and memory allocations, this can lead to undersized buffers being allocated while larger amounts of data are written, creating memory corruption conditions. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) indicates all Chrome desktop installations, but the description specifically limits impact to Windows platforms where Dawn's implementation differs from other operating systems. The sandbox escape classification means successful exploitation breaks out of Chrome's renderer process isolation, potentially allowing code execution with user-level system privileges.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately (confirmed fix version per Google Stable Channel update May 2026). Chrome's built-in auto-update mechanism will deploy this patch automatically for most users within 24-48 hours. Enterprise administrators should push version 148.0.7778.96 via group policy or management consoles (WSUS, SCCM, Chrome Enterprise policies). For environments where patching is delayed, disable WebGPU functionality by setting the Chrome flag chrome://flags/#enable-unsafe-webgpu to 'Disabled' - this prevents Dawn from executing but breaks legitimate WebGPU applications and 3D web content, making it unsuitable for long-term use. Additional compensating control: restrict Chrome usage to trusted sites only via URL allowlisting policies until patching completes. No network-level mitigations are effective since exploitation occurs client-side after HTML delivery. Advisory and technical details: chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and Chromium issue tracker issues/497565944.