What is the CVSS score of CVE-2026-7997?

CVE-2026-7997 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-7997?

Google Chrome for macOS versions prior to 148.0.7778.96 contain a local privilege escalation vulnerability in the updater component that could allow attackers with local access to gain administrative…. A patch is available.

How to fix or mitigate CVE-2026-7997?

Within 24 hours: Verify current Chrome version distribution across macOS endpoints using your device management platform. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all macOS systems via your software distribution mechanism (MDM, Jamf, Microsoft Intune, or equivalent). Within 30 days: Audit local file permissions on macOS systems and review access logs for any suspicious updater-related activity prior to patching.

Google Chrome CVE-2026-7997

EUVD-2026-28097 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Privilege Escalation Google Red Hat Suse Chrome

High

Disputed · 7.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 7.8

DescriptionCVE.org

Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)

AnalysisAI

Local privilege escalation in Google Chrome's macOS Updater component allows attackers to gain OS-level administrative privileges through malicious files. The flaw affects Chrome versions prior to 148.0.7778.96 on macOS and requires user interaction to exploit. Google has released Chrome 148.0.7778.96 to address this vulnerability. Despite the 7.8 CVSS score, Google rates this as Low severity, reflecting the local attack vector and user interaction requirement that significantly constrain real-world exploitation scenarios.

Technical ContextAI

This vulnerability (CWE-20: Improper Input Validation) resides in Chrome's Updater component, which manages browser updates on macOS. The Updater runs with elevated privileges to install system-wide updates, making it an attractive privilege escalation target. The insufficient validation of untrusted input means the Updater fails to properly sanitize or verify file inputs before processing them with elevated permissions. When a malicious file is processed, the attacker can leverage the Updater's privileged context to execute code at the OS level, breaking out of Chrome's sandbox and the user's permission boundaries. This type of vulnerability typically involves path traversal, symlink manipulation, or unsafe file operations in privileged code paths. The CPE identifier cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects the Chrome application specifically on macOS platforms.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, which contains the vendor-supplied fix for this privilege escalation vulnerability. Chrome's built-in auto-update mechanism will deploy this patch automatically for most users within 24-48 hours of release. Enterprise administrators using managed Chrome deployments should verify that update policies allow Chrome 148.x and confirm successful deployment via chrome://settings/help or central management consoles. Refer to the official stable channel update at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for release notes and the Chromium bug tracker issue 487960705 for technical context. No workarounds are documented because the vulnerability requires both local access and user interaction, making compensating controls impractical. Organizations concerned about zero-day exposure windows should consider blocking execution of unknown files from untrusted sources via macOS Gatekeeper policies, though this may impact legitimate workflows and does not specifically mitigate this Updater vulnerability.