What is the CVSS score of CVE-2026-7995?

CVE-2026-7995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-7995?

CVE-2026-7995 is a high-severity remote code execution vulnerability in Google Chrome's AdFilter component that allows attackers to execute arbitrary code through a malicious webpage without user…. A patch is available.

How to fix or mitigate CVE-2026-7995?

Within 24 hours: Identify all Chrome deployments in your environment and verify current version numbers. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all endpoints via your standard patch management process (MDM, WSUS, or enterprise update channels); prioritize systems handling sensitive data or used for privileged access. Within 30 days: Confirm 100% deployment completion and verify no instances of Chrome remain on pre-148.0.7778.96 versions through endpoint auditing.

Google Chrome CVE-2026-7995

EUVD-2026-28093 HIGH

Out-of-bounds Read (CWE-125)

2026-05-06 Chrome

Google Information Disclosure RCE Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution within Chrome's sandbox affects all versions prior to 148.0.7778.96 through an out-of-bounds read vulnerability in the AdFilter component. Attackers can execute arbitrary code by delivering a specially crafted HTML page, requiring only that a user visit the malicious page. Chrome has released version 148.0.7778.96 to address this vulnerability. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code at time of analysis, though the vulnerability's network-based attack vector and low complexity make it a realistic exploitation target once technical details become public.

Technical ContextAI

This vulnerability affects Google Chrome's AdFilter component, part of Chrome's content filtering and ad-blocking infrastructure. The root cause is an out-of-bounds read (CWE-125), a memory safety issue where the application reads data beyond the boundaries of an allocated buffer. In Chrome's multi-process architecture, this occurs within the sandboxed renderer process responsible for parsing and displaying web content. The affected CPE (cpe:2.3:a:google:chrome) encompasses all Chrome distributions across Windows, macOS, Linux, and ChromeOS platforms. Out-of-bounds reads can leak sensitive memory contents and, when chained with other vulnerabilities or specific memory layouts, enable arbitrary code execution within the sandbox boundary. The AdFilter component processes advertiser-controlled HTML content, making it an attractive attack surface for malicious actors.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome's auto-update mechanism will deploy this patch automatically for most users within 24-48 hours; administrators can verify the installed version by navigating to chrome://settings/help. Enterprise environments using managed Chrome deployments should push the update through their software distribution systems and verify deployment completion. For Chromium-based browsers (Edge, Brave, Opera, Vivaldi), monitor vendor security channels for equivalent patches as they sync upstream Chromium fixes. As a temporary compensating control while awaiting patch deployment, organizations can restrict browsing to trusted domains through enterprise policy (URLBlocklist/URLAllowlist), though this significantly impacts productivity and should only be considered for high-risk users handling sensitive data. Disabling JavaScript via chrome://settings/content offers defense-in-depth but breaks most modern web applications. Network-layer defenses (web proxies, DNS filtering) can block known malicious domains but provide limited protection against targeted attacks using novel infrastructure. All compensating controls are partial mitigations only-patching remains the primary remediation.