What is the CVSS score of CVE-2026-7996?

CVE-2026-7996 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-7996?

Yes, a patch is available for CVE-2026-7996. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7996

EUVD-2026-28095 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

3.1 LOW

Renderer pre-compromise drives AC:H; UI spoofing yields only limited confidentiality impact; no availability or integrity effect is supported by the description.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

2.6 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:36 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.2 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 4.2

DescriptionCVE.org

Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's SSL input validation layer affects all versions prior to 148.0.7778.96, requiring an attacker to have already compromised the renderer process before the flaw can be leveraged via a crafted HTML page. This is a chained, second-stage capability - not a standalone initial-access vector - rated Low severity by the Chromium security team and scoring 4.2 CVSS. No public exploit code exists, EPSS sits at 0.07% (21st percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the lower tier of Chrome's vulnerability landscape.

Technical ContextAI

The flaw exists in Chrome's SSL handling component and is classified as CWE-20 (Improper Input Validation): the SSL subsystem fails to sufficiently validate untrusted data arriving from the renderer process, allowing a compromised renderer to influence SSL-related UI elements - such as certificate indicators or security status display - in ways the browser process should not permit. Chromium's multi-process architecture sandboxes the renderer, but this sandbox does not compensate for insufficient validation of inter-process messages when a renderer has already been compromised. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop platforms (Windows, macOS, Linux) prior to the patched stable channel release.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism handles this for most consumer deployments; enterprise administrators should confirm the rollout via fleet management tooling or Chrome Browser Cloud Management. Because exploitation unconditionally requires a prior renderer compromise, organizations that cannot immediately deploy the patch should focus compensating controls on preventing renderer-level exploitation: ensure Chrome's strict site isolation (--site-per-process) and sandbox enforcement are not disabled by policy, as these raise the bar for the prerequisite renderer compromise stage. Red Hat and SUSE users should apply distribution-provided package updates when available. No workaround eliminates the root SSL validation flaw without patching.