What is the CVSS score of CVE-2026-7995?

CVE-2026-7995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7995?

CVE-2026-7995 is a high-severity remote code execution vulnerability in Google Chrome's AdFilter component that allows attackers to execute arbitrary code through a malicious webpage without user…. A patch is available.

How to fix or mitigate CVE-2026-7995?

Within 24 hours: Identify all Chrome deployments in your environment and verify current version numbers. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all endpoints via your standard patch management process (MDM, WSUS, or enterprise update channels); prioritize systems handling sensitive data or used for privileged access. Within 30 days: Confirm 100% deployment completion and verify no instances of Chrome remain on pre-148.0.7778.96 versions through endpoint auditing.

Google Chrome CVE-2026-7995

EUVD-2026-28093 HIGH

Out-of-bounds Read (CWE-125)

2026-05-06 Chrome

Google Information Disclosure RCE Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution within Chrome's sandbox affects all versions prior to 148.0.7778.96 through an out-of-bounds read vulnerability in the AdFilter component. Attackers can execute arbitrary code by delivering a specially crafted HTML page, requiring only that a user visit the malicious page. Chrome has released version 148.0.7778.96 to address this vulnerability. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code at time of analysis, though the vulnerability's network-based attack vector and low complexity make it a realistic exploitation target once technical details become public.

Technical ContextAI

This vulnerability affects Google Chrome's AdFilter component, part of Chrome's content filtering and ad-blocking infrastructure. The root cause is an out-of-bounds read (CWE-125), a memory safety issue where the application reads data beyond the boundaries of an allocated buffer. In Chrome's multi-process architecture, this occurs within the sandboxed renderer process responsible for parsing and displaying web content. The affected CPE (cpe:2.3:a:google:chrome) encompasses all Chrome distributions across Windows, macOS, Linux, and ChromeOS platforms. Out-of-bounds reads can leak sensitive memory contents and, when chained with other vulnerabilities or specific memory layouts, enable arbitrary code execution within the sandbox boundary. The AdFilter component processes advertiser-controlled HTML content, making it an attractive attack surface for malicious actors.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome's auto-update mechanism will deploy this patch automatically for most users within 24-48 hours; administrators can verify the installed version by navigating to chrome://settings/help. Enterprise environments using managed Chrome deployments should push the update through their software distribution systems and verify deployment completion. For Chromium-based browsers (Edge, Brave, Opera, Vivaldi), monitor vendor security channels for equivalent patches as they sync upstream Chromium fixes. As a temporary compensating control while awaiting patch deployment, organizations can restrict browsing to trusted domains through enterprise policy (URLBlocklist/URLAllowlist), though this significantly impacts productivity and should only be considered for high-risk users handling sensitive data. Disabling JavaScript via chrome://settings/content offers defense-in-depth but breaks most modern web applications. Network-layer defenses (web proxies, DNS filtering) can block known malicious domains but provide limited protection against targeted attacks using novel infrastructure. All compensating controls are partial mitigations only-patching remains the primary remediation.