What is the CVSS score of CVE-2026-8003?

CVE-2026-8003 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8003?

Yes, a patch is available for CVE-2026-8003. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8003

EUVD-2026-28109 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

5.4 MEDIUM

UI spoofing carries integrity impact (I:L) by definition; no availability impact applies, correcting the vendor vector's A:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:34 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 5.4

DescriptionCVE.org

Insufficient validation of untrusted input in TabGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.

Technical ContextAI

The affected component is Google Chrome's TabGroups feature - the browser subsystem responsible for grouping and rendering tab collections in the UI. The root cause class is CWE-20 (Improper Input Validation): data arriving via network traffic is not adequately sanitized before being processed or rendered within the TabGroups UI context. This allows an attacker-controlled network response to influence visual elements of the browser chrome, a classic UI redress/spoofing surface. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome application builds across platforms (Windows, macOS, Linux, and likely ChromeOS) for versions below the fixed release 148.0.7778.96, as confirmed by the EUVD affected-version range. Distribution coverage by Red Hat and SUSE tags suggests downstream Linux packaging carries the same exposure.

RemediationAI

The primary remediation is upgrading Google Chrome to version 148.0.7778.96 or later, as released in the stable channel update documented at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this for most desktop users without manual intervention; administrators managing enterprise deployments should verify rollout via Chrome Browser Cloud Management or group policy. For Linux environments managed by Red Hat or SUSE, apply the updated Chrome package through the standard distribution package manager once downstream packages are published. No specific workaround for the TabGroups input validation flaw is documented; organizations with high-risk user populations (e.g., executives, finance teams) may temporarily disable TabGroups via enterprise policy (TabGroupsEnabled=false) as a compensating control, though this removes productivity functionality. No patch version other than 148.0.7778.96 is independently confirmed.