What is the CVSS score of CVE-2026-8000?

CVE-2026-8000 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of ChromeDriver are affected by CVE-2026-8000?

Google Chrome versions prior to 148.0.7778.96 contain a high-severity remote code execution vulnerability in ChromeDriver that allows attackers to execute arbitrary code on Windows systems through…. A patch is available.

How to fix or mitigate CVE-2026-8000?

Within 24 hours: Identify all Windows systems running Google Chrome versions prior to 148.0.7778.96 using endpoint management tools; disable or restrict ChromeDriver usage if not operationally required. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via your software distribution mechanism to all Windows endpoints; verify installation completion across 95% of fleet. Within 30 days: Achieve 100% compliance; conduct audit of ChromeDriver usage in automated testing or development environments and apply equivalent patch versions to those systems.

ChromeDriver CVE-2026-8000

EUVD-2026-28103 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Microsoft RCE Google Red Hat Suse Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution affects ChromeDriver in Google Chrome versions prior to 148.0.7778.96 on Windows platforms. Exploitation requires user interaction with a malicious HTML page, enabling remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. Vendor-released patch available (version 148.0.7778.96). No active exploitation confirmed in CISA KEV at time of analysis, though CVSS base score of 8.8 reflects significant potential impact if users visit attacker-controlled content.

Technical ContextAI

ChromeDriver is the WebDriver implementation for Chromium/Chrome browsers, enabling automated testing and browser control. This vulnerability stems from CWE-20 (Improper Input Validation), where ChromeDriver fails to sufficiently sanitize untrusted input when processing HTML page content on Windows systems. The affected component (CPE: cpe:2.3:a:google:chrome) specifically targets the ChromeDriver binary bundled with Chrome browser distributions. The input validation flaw allows attacker-crafted HTML to bypass security controls and inject executable code into the ChromeDriver process context. Notably, Google assigned this a 'Low' internal security severity despite the 8.8 CVSS score, suggesting limited practical exploitability or narrow attack scenarios in real-world deployments.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later via the browser's built-in update mechanism (Settings > About Chrome) or through enterprise deployment channels for managed environments. The stable channel update published at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html addresses this and related vulnerabilities. For environments unable to immediately patch, implement defense-in-depth controls: restrict ChromeDriver usage to trusted, validated HTML content only; disable automated browsing of external/untrusted websites in testing frameworks; deploy application allowlisting to prevent unauthorized code execution from browser processes; monitor ChromeDriver process behavior for unexpected child process spawning or network connections. Note these mitigations reduce but do not eliminate risk, and restricting ChromeDriver functionality may break automated testing workflows dependent on processing diverse web content. Enterprise administrators should prioritize Windows systems running ChromeDriver in production automation contexts over standard end-user Chrome installations where ChromeDriver typically remains dormant.