What is the CVSS score of CVE-2026-7992?

CVE-2026-7992 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7992?

Google Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability affecting Linux and ChromeOS users, allowing attackers to execute arbitrary code through malicious webpages…. A patch is available.

How to fix or mitigate CVE-2026-7992?

Within 24 hours: Identify all Chrome installations on Linux and ChromeOS systems via endpoint management tools and catalog current versions. Within 7 days: Deploy Chrome version 148.0.7778.96 or later across all affected systems using your standard patch management process; prioritize developer workstations and systems with elevated privileges. Within 30 days: Verify 100% deployment completion through endpoint telemetry and confirm no systems remain on versions prior to 148.0.7778.96.

Google Chrome CVE-2026-7992

EUVD-2026-28087 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:34 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.96 on Linux and ChromeOS allows attackers to execute arbitrary code when users perform specific UI gestures on a malicious webpage. The vulnerability stems from insufficient input validation in Chrome's UI layer (CWE-20). Vendor patch available in Chrome 148.0.7778.96. No public exploit identified at time of analysis, though CVSS 8.8 reflects high impact across confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability exists in Google Chrome's UI handling layer on Linux and ChromeOS platforms, specifically in how the browser validates untrusted input before processing user interface gestures. CWE-20 (Improper Input Validation) indicates the root cause is failure to properly sanitize or validate data before use in UI operations. The affected component processes HTML page content and user interactions, creating a pathway for malicious input to reach privileged browser functions. Chrome's UI layer bridges web content with native operating system interfaces, making input validation failures in this component particularly dangerous as they can bypass browser sandbox protections when combined with specific user gestures. The platform-specific nature (Linux/ChromeOS only) suggests the vulnerability involves UI frameworks or system calls unique to these environments.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via browser's built-in update mechanism (Settings → About Chrome) or system package manager on Linux distributions. Enterprise deployments should push Chrome 148.0.7778.96 through managed update channels. For environments unable to patch immediately, implement defense-in-depth controls: restrict browsing to trusted domains via enterprise policy (URLBlocklist/URLAllowlist), deploy web filtering to block known-malicious sites, and educate users to avoid unusual UI gesture requests from untrusted websites (though specifics of required gestures are not disclosed, reducing mitigation effectiveness). Consider temporarily disabling Chrome on Linux/ChromeOS systems handling sensitive data if immediate patching is impossible, switching to unaffected browsers until update deployment. No workarounds bypass the vulnerability completely - patching is the only complete remediation. Consult official advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for additional vendor guidance.