What is the CVSS score of CVE-2026-7999?

CVE-2026-7999 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-7999?

Yes, a patch is available for CVE-2026-7999. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-7999

EUVD-2026-28101 MEDIUM

Information Exposure (CWE-200)

2026-05-06 Chrome

Information Disclosure Google

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted HTML mandates user page visit (UI:R); memory leak is scoped to renderer process (S:U) with only partial confidentiality loss and no write or denial-of-service impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.

Technical ContextAI

The flaw resides in V8, Google Chrome's open-source JavaScript and WebAssembly engine responsible for parsing and executing JavaScript in the renderer process. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) classifies the root cause as an inappropriate implementation within V8 that inadvertently surfaces process memory contents - likely heap or stack data - that web content should not be able to observe. V8 manages complex memory layouts for JIT-compiled code, object heaps, and execution contexts; implementation gaps in bounds checking, type handling, or memory initialization can produce observable information leaks without triggering a crash. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 148.0.7778.96. Tags also indicate downstream Chromium-based packages for Red Hat and SUSE are in scope.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later; this is the vendor-confirmed fixed release documented in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deliver this fix automatically to most users; administrators should verify deployment via chrome://settings/help or enterprise management consoles. For Red Hat and SUSE environments running distribution-packaged Chromium, monitor vendor security channels for updated RPM or DEB packages incorporating this fix - timelines will vary by distro. As a compensating control prior to patching in managed environments, restrict navigation to untrusted external web content via enterprise browser policies (e.g., URL allowlisting, SafeBrowsing enforcement) to reduce exposure to crafted pages; note this trade-off reduces general browsing capability.