What is the CVSS score of CVE-2026-7975?

CVE-2026-7975 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7975?

Google Chrome versions below 148.0.7778.96 contain a sandbox escape vulnerability in DevTools that allows attackers with renderer process access to achieve system-level code execution.. A patch is available.

How to fix or mitigate CVE-2026-7975?

Within 24 hours: Inventory Chrome deployment scope across managed and unmanaged endpoints; create communication plan for users. Within 7 days: Deploy Chrome 148.0.7778.96 or later via your endpoint management tool (MDM/SCCM/Jamf); verify rollout to 95%+ of endpoints. Within 30 days: Complete full deployment verification; conduct audit of Chrome versions in use; implement automated patching policy for Chrome browser updates.

Google Chrome CVE-2026-7975

EUVD-2026-28053 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's DevTools component allows attackers who have already compromised the renderer process to break out of the browser sandbox and execute code on the underlying system. Affects all Chrome versions prior to 148.0.7778.96. Google has released version 148.0.7778.96 to patch this vulnerability. The attack requires high complexity and user interaction (visiting a malicious page), but successful exploitation enables complete system compromise with changed scope (S:C in CVSS vector), escalating from renderer-level access to full system access. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis.

Technical ContextAI

This vulnerability stems from a use-after-free condition (CWE-416) in Chrome's DevTools component, which is the browser's built-in developer inspection and debugging toolkit. Use-after-free bugs occur when code continues to reference memory after it has been deallocated, allowing attackers to manipulate freed memory and redirect program execution. In Chrome's multi-process architecture, the renderer process handles web content in an isolated sandbox, while privileged operations require breaking out to the browser process. This DevTools UAF provides that escape path. The CPE identifier cpe:2.3:a:google:chrome confirms all Chrome desktop installations prior to version 148.0.7778.96 are affected across Windows, macOS, and Linux platforms. The vulnerability is classified as Medium severity by Chromium security team despite the 8.3 CVSS score, suggesting mitigating factors in their internal risk assessment.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome typically auto-updates within 24-48 hours of release; users can force immediate update via Settings > About Chrome or by restarting the browser when the update notification appears. Enterprise deployments should push version 148.0.7778.96 through their managed update infrastructure (Google Admin Console for Chrome Enterprise, WSUS, or third-party patch management). Full advisory available at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and technical details at https://issues.chromium.org/issues/497735587. If immediate patching is not feasible, implement compensating controls: disable DevTools access via Chrome Enterprise Policy (DeveloperToolsAvailability set to 2) to prevent the vulnerable component from being accessible, though this breaks legitimate developer workflows and should only be temporary; restrict browser usage to trusted sites only via URL allowlists, reducing renderer compromise opportunities; deploy browser isolation solutions (remote browser or network-level isolation) to contain potential sandbox escapes at the network boundary. These mitigations significantly impact usability and are NOT substitutes for patching.