What is the CVSS score of CVE-2026-7990?

CVE-2026-7990 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7990?

CVE-2026-7990 is a local privilege escalation vulnerability in Google Chrome's Windows updater that allows unprivileged users to escalate to SYSTEM-level access, potentially enabling attackers to…. A patch is available.

How to fix or mitigate CVE-2026-7990?

Within 24 hours: Inventory all Windows systems running Google Chrome versions prior to 148.0.7778.96 using endpoint detection tools. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via your standard patch management process, prioritizing systems where auto-update is disabled or delayed. Within 30 days: Verify 100% compliance through automated scanning and audit Chrome update configurations to ensure auto-update is enabled enterprise-wide.

Google Chrome CVE-2026-7990

EUVD-2026-28083 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Privilege Escalation Microsoft Google Red Hat Suse Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:34 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 7.8

DescriptionCVE.org

Insufficient validation of untrusted input in Updater in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome's Windows updater component allows unprivileged users to gain SYSTEM-level access by exploiting insufficient input validation when the updater processes a specially crafted malicious file. Affects all Chrome versions on Windows prior to 148.0.7778.96. Google has released a patched version (148.0.7778.96). No active exploitation confirmed by CISA KEV at time of analysis, though the local attack vector and medium severity rating suggest potential for targeted attacks in enterprise environments where Chrome auto-update may be delayed.

Technical ContextAI

This vulnerability resides in Google Chrome's update mechanism on Windows platforms, specifically affecting the Updater component responsible for downloading, validating, and installing browser updates. The root cause is CWE-20 (Improper Input Validation), where the updater fails to adequately sanitize or validate file inputs before processing them with elevated privileges. Chrome's updater typically runs with SYSTEM-level privileges on Windows to install updates for all users, creating an attack surface when processing untrusted files. The affected CPE (cpe:2.3:a:google:chrome) confirms this is a Chrome application vulnerability rather than a Chromium-specific issue, though the fix originates from the Chromium project (issue 498892267). The local attack vector (AV:L) combined with no privilege requirements (PR:N) but required user interaction (UI:R) indicates the updater processes files in a user-accessible location or accepts user-provided input during the update process.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via the built-in updater (chrome://settings/help will trigger automatic update check and installation) or by downloading the latest stable release from google.com/chrome. For enterprise environments using managed Chrome deployments, deploy version 148.0.7778.96 through existing software distribution mechanisms (SCCM, Intune, GPO-based MSI deployment). Vendor advisory with full release notes: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. If immediate patching is not feasible, implement compensating controls: restrict local user permissions to prevent execution of untrusted files in directories accessible to the Chrome updater service (typically requires auditing %ProgramFiles%\Google\Chrome and %LOCALAPPDATA%\Google paths), apply application whitelisting policies to block unauthorized executables from user-writable locations, and enforce standard user (non-administrator) desktop policies to limit the impact of privilege escalation attempts. Note that blocking the updater service itself is NOT recommended as it prevents security updates and creates greater long-term risk. Monitor Windows event logs for unusual GoogleUpdate.exe or chrome_updater.exe process behavior or unexpected privilege escalation events (Event ID 4672, 4673, 4688 with elevated tokens).