What is the CVSS score of CVE-2026-7994?

CVE-2026-7994 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-7994?

Google Chrome Chromoting versions prior to 148.0.7778.96 contain a local privilege escalation vulnerability that allows attackers to gain elevated system privileges on Windows through user-initiated…. A patch is available.

How to fix or mitigate CVE-2026-7994?

Within 24 hours: Identify all Windows systems running Chrome Chromoting prior to version 148.0.7778.96 using endpoint inventory or Mobile Device Management (MDM) tools. Within 7 days: Deploy Chrome Chromoting version 148.0.7778.96 or later via automated update mechanisms or group policy where applicable; prioritize systems with elevated user privileges. Within 30 days: Verify 100% deployment coverage through compliance scanning and conduct user awareness training on file-opening risks from untrusted sources.

Google Chrome CVE-2026-7994

EUVD-2026-28091 HIGH

Improper Privilege Management (CWE-269)

2026-05-06 Chrome

Privilege Escalation Microsoft Google Red Hat Suse Chrome

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 7.8

DescriptionCVE.org

Inappropriate implementation in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome Chromoting (prior to 148.0.7778.96) on Windows allows attackers to gain elevated OS-level privileges by tricking users into opening a malicious file. While CVSS scores this as high severity (7.8), real-world risk is tempered by local access and required user interaction (CVSS: AV:L/UI:R). Vendor patch available in version 148.0.7778.96 released May 2026. No active exploitation (CISA KEV) or public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability affects Google Chrome's Chromoting component, the remote desktop solution integrated into Chrome for Windows platforms. The root cause is CWE-269 (Improper Privilege Management), indicating the Chromoting implementation fails to properly validate or sanitize file operations, allowing a crafted file to trigger code execution with elevated system privileges. The inappropriate implementation likely involves insufficient privilege separation between user-level Chrome processes and system-level operations required for remote desktop functionality. Chrome's sandboxing architecture typically prevents such escalations, suggesting this flaw bypasses normal isolation boundaries within the Chromoting-specific code path.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later, released May 2026 via Google's stable channel update. Chrome's automatic update mechanism will deploy this patch within 24-48 hours for most installations; enterprise administrators should verify deployment through Chrome Browser Cloud Management or GPO-managed updates. For environments unable to immediately patch, implement compensating controls: disable Chrome Remote Desktop feature via Group Policy (ExtensionInstallBlocklist policy targeting Chromoting extension ID), restrict file execution via Windows AppLocker or Software Restriction Policies to prevent untrusted file execution, and enforce least-privilege user accounts to limit escalation impact (though PR:N indicates unprivileged users can exploit this). Note that disabling Chromoting breaks legitimate remote access workflows. Advisory and patch details: chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html.