What is the CVSS score of CVE-2026-7976?

CVE-2026-7976 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7976?

Google Chrome versions before 148.0.7778.96 contain a use-after-free vulnerability in the Views component that allows remote code execution through malicious extensions.. A patch is available.

How to fix or mitigate CVE-2026-7976?

Within 24 hours: Verify current Chrome versions across the organization and identify any users below 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later via your standard patch management process to all user devices; configure Chrome auto-update settings to enforce automatic updates if not already enabled. Within 30 days: Conduct a compliance audit to confirm 100% deployment; implement extension management policies (allowlist approved extensions, block installation of untrusted extensions) via Chrome Enterprise policies or equivalent mobile device management controls.

Google Chrome CVE-2026-7976

EUVD-2026-28055 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:32 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.96 via malicious extension exploitation of use-after-free in Views component. Successful exploitation requires convincing a user to install a crafted Chrome extension, after which the attacker can execute arbitrary code with Chrome's privileges. Google has released Chrome 148.0.7778.96 to address this vulnerability. No evidence of active exploitation (not listed in CISA KEV) or public proof-of-concept code identified at time of analysis. CVSS 7.5 severity driven by high attack complexity and required user interaction, which moderates real-world exploitation risk despite potential for full system compromise.

Technical ContextAI

This vulnerability stems from a use-after-free (CWE-416) memory corruption flaw in Chrome's Views UI framework, which handles user interface components and rendering. Use-after-free vulnerabilities occur when code attempts to access memory that has already been deallocated, creating opportunities for attackers to control the freed memory region and redirect program execution. In this case, the flaw can be triggered through Chrome's extension API, allowing malicious extensions to manipulate the Views component's memory lifecycle. The affected product CPE (cpe:2.3:a:google:chrome) indicates all Chrome installations across Windows, macOS, and Linux platforms are vulnerable prior to version 148.0.7778.96. The extension delivery vector is significant because Chrome's extension permissions model can grant extensive access to browser internals, making this a particularly effective attack surface once the initial social engineering succeeds.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately through Chrome's built-in update mechanism (Settings > About Chrome) or by downloading from google.com/chrome. Chrome typically auto-updates within 24-48 hours, but manual update verification is recommended for critical systems. For enterprise deployments, push Chrome 148.0.7778.96 via group policy or endpoint management tools. Interim compensating controls include: (1) Restricting extension installation to admin-approved Chrome Web Store items only via ExtensionInstallBlocklist and ExtensionInstallAllowlist policies, which prevents installation of malicious extensions but may impact productivity for users requiring custom extensions; (2) Disabling developer mode extensions entirely via DeveloperToolsAvailability policy, which blocks sideloading vectors but prevents legitimate development work; (3) Implementing enhanced user awareness training focused on extension permission requests, particularly those requesting broad host permissions or access to sensitive browser APIs, though this relies on user judgment and is not technically preventative. Full advisory available at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.