What is the CVSS score of CVE-2026-7978?

CVE-2026-7978 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7978?

Google Chrome for macOS versions prior to 148.0.7778.96 contain a high-severity privilege escalation vulnerability in the Companion component that allows unauthenticated remote attackers to gain…. A patch is available.

How to fix or mitigate CVE-2026-7978?

Within 24 hours: Identify and inventory all macOS devices running Chrome versions below 148.0.7778.96 via MDM or asset management tools. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all affected macOS endpoints using automated update mechanisms or MDM enforcement; validate successful installation across 95% of inventory. Within 30 days: Conduct post-deployment verification, audit Companion component logs for suspicious activity, and document exception cases for devices unable to update with compensating controls.

Google Chrome CVE-2026-7978

EUVD-2026-28059 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Privilege Escalation Google Red Hat Suse Chrome

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

10.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:32 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.1 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

OS-level privilege escalation in Google Chrome for macOS allows remote attackers to gain elevated system privileges through malicious network traffic exploiting the Companion component. Affects all Chrome versions prior to 148.0.7778.96 on Mac. Vendor-released patch available (Chrome 148.0.7778.96). No public exploit or active exploitation confirmed at time of analysis, though high-complexity network-based attack vector (CVSS AV:N/AC:H) suggests specialized exploitation requirements despite unauthenticated remote access.

Technical ContextAI

The vulnerability affects the Companion component in Google Chrome's macOS implementation, which handles companion device integration and cross-device functionality. Classified under CWE-693 (Protection Mechanism Failure), indicating improper enforcement of security boundaries between browser-level and OS-level privileges. The inappropriate implementation allows network-originated attacks to bypass macOS privilege boundaries, escalating from browser context to OS-level access. This represents a critical trust boundary violation where web content processing leads to system-level compromise. Affects cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* specifically on macOS platforms prior to version 148.0.7778.96.

RemediationAI

Update Google Chrome on macOS to version 148.0.7778.96 or later, released via Google's stable channel update in May 2026 (chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html). Chrome's automatic update mechanism will apply the patch for most users within 48 hours of release. Administrators can force immediate update via chrome://settings/help or deploy version 148.0.7778.96+ through enterprise management tools (Google Update for Enterprise, MDM solutions). If immediate patching is not feasible, compensating controls include: restricting Chrome usage to trusted networks only (blocks malicious network traffic vector but significantly limits browser utility), deploying network-level traffic inspection to detect anomalous Companion component traffic patterns (requires deep packet inspection capability and updated threat signatures), or temporarily disabling Chrome's companion device features if organizationally acceptable (may break cross-device sync and handoff workflows). All workarounds carry operational trade-offs versus patching.