What is the CVSS score of CVE-2026-7974?

CVE-2026-7974 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7974?

Google Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability in the Blink rendering engine that allows attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-7974?

Within 24 hours: Identify all Chrome deployments in your environment and confirm current versions via endpoint management tools. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all endpoints using your standard patch management process (manual update, MDM, or Group Policy). Within 30 days: Verify 100% deployment completion and document patch status in your vulnerability management system.

Google Chrome CVE-2026-7974

EUVD-2026-28051 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.96 allows attackers to execute arbitrary code within the browser's sandbox by exploiting a use-after-free vulnerability in the Blink rendering engine through a specially crafted HTML page. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires user interaction (visiting a malicious webpage). EPSS data not available. Not listed in CISA KEV at time of analysis. Vendor-released patch available in Chrome 148.0.7778.96.

Technical ContextAI

This vulnerability exists in Blink, Google Chrome's rendering engine responsible for parsing and displaying web content including HTML, CSS, and JavaScript. The root cause is a use-after-free memory corruption issue (CWE-416), which occurs when the rendering engine attempts to access memory that has already been freed. In Blink's complex object lifecycle management during DOM manipulation or JavaScript execution, timing vulnerabilities can cause pointers to persist after their referenced objects are deallocated. When the code subsequently dereferences these dangling pointers, attackers can manipulate heap memory to redirect execution flow. The CPE identifier cpe:2.3:a:google:chrome confirms this affects the Google Chrome application across all platforms where Blink is used (Windows, macOS, Linux, ChromeOS).

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately through the browser's built-in update mechanism (Settings > About Chrome) or by downloading from google.com/chrome. Chrome's auto-update feature typically deploys patches within 24-48 hours for actively used installations. Enterprise deployments should push version 148.0.7778.96 through existing software distribution channels and verify update completion across managed endpoints. Verify patched version by navigating to chrome://settings/help. If immediate patching is not feasible, implement compensating controls: restrict web browsing to trusted domains through DNS filtering or web proxies, deploy browser isolation technologies to execute untrusted web content in disposable virtual environments separate from the endpoint, and enforce strict Content Security Policy headers on internal web applications to limit execution of external resources. Note that disabling JavaScript provides defense-in-depth but severely impacts web functionality and is not practical for most users. Detailed security advisory and issue tracker available at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and issues.chromium.org/issues/497649372.