What is the CVSS score of CVE-2026-7991?

CVE-2026-7991 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7991?

Google Chrome versions prior to 148.0.7778.96 contain a use-after-free vulnerability in the UI component that allows sandbox escape and arbitrary code execution, requiring initial renderer process…. A patch is available.

How to fix or mitigate CVE-2026-7991?

Within 24 hours: Inventory Chrome deployments across the organization and identify version numbers below 148.0.7778.96. Within 7 days: Deploy Chrome 148.0.7778.96 or later via your standard patch management process to all endpoints; prioritize systems handling sensitive data or high-value targets. Within 30 days: Confirm 100% deployment completion and validate no systems remain on affected versions through vulnerability scanning.

Google Chrome CVE-2026-7991

EUVD-2026-28085 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:34 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome prior to 148.0.7778.96 through a use-after-free vulnerability in the UI component. Attackers who have already compromised the renderer process can escape sandbox restrictions and execute arbitrary code by delivering a specially crafted HTML page requiring user interaction. Google has released patch version 148.0.7778.96. No active exploitation confirmed in CISA KEV at time of analysis, though the vulnerability requires prior renderer compromise which increases attack complexity beyond the CVSS AC:L rating suggests.

Technical ContextAI

This is a use-after-free (CWE-416) memory corruption vulnerability in Google Chrome's UI subsystem. Use-after-free occurs when code continues to use a memory pointer after the referenced object has been deallocated, allowing attackers to manipulate freed memory and redirect program execution. In Chrome's multi-process architecture, this vulnerability affects the browser process UI layer rather than the sandboxed renderer. The CVSS vector AV:N/AC:L/PR:N/UI:R indicates network-based delivery requiring user interaction, but critically, the CVE description specifies that successful exploitation requires the attacker to have ALREADY compromised the renderer process-a significant prerequisite not reflected in the PR:N (no privileges required) metric. This represents a sandbox escape vulnerability rather than a direct remote exploitation vector.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome typically auto-updates within 24-48 hours, but users should manually check chrome://settings/help to force an immediate update and restart. Enterprise deployments using managed Chrome should push version 148.0.7778.96 through their update management systems. The official vendor advisory is available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. No workarounds are provided-patching is the only complete remediation. For organizations unable to patch immediately, defense-in-depth measures include restricting Chrome usage to trusted sites only, enabling Enhanced Safe Browsing (chrome://settings/security) to detect malicious pages, and isolating high-risk users in virtualized or sandboxed environments, though these compensating controls do not prevent exploitation and only reduce attack surface.