What is the CVSS score of CVE-2026-8007?

CVE-2026-8007 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-8007?

Google Chrome versions prior to 148.0.7778.96 contain a privilege escalation vulnerability in the Cast component that could allow attackers to escalate from renderer to browser process following…. A patch is available.

How to fix or mitigate CVE-2026-8007?

Within 24 hours: Verify current Chrome version across endpoints (chrome://version). Within 7 days: Deploy Chrome 148.0.7778.96 or later to all endpoints via your standard patch management process; configure automatic updates if not already enabled. Within 30 days: Audit logs for any suspicious Cast component activity or unexpected privilege escalation events to assess historical exposure.

Google Chrome CVE-2026-8007

EUVD-2026-28117 HIGH

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Privilege Escalation Google Red Hat Suse Chrome

High

Disputed · 7.5 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:36 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome's Cast component (versions prior to 148.0.7778.96) allows remote attackers to elevate from renderer to higher-privilege browser process via specially crafted HTML page after initial renderer compromise. Despite 7.5 CVSS score, Chromium security team rates this as Low severity, indicating limited real-world impact. Vendor patch released in version 148.0.7778.96. No public exploit identified at time of analysis.

Technical ContextAI

This vulnerability affects Google Chrome's Cast component (used for streaming media to Chromecast devices) prior to version 148.0.7778.96. The root cause is CWE-20 (Improper Input Validation), where the Cast implementation fails to properly validate untrusted input crossing the renderer process boundary. Chrome uses a multi-process architecture where renderer processes (sandboxed, low-privilege) handle untrusted web content, while the browser process operates at higher privilege. This vulnerability allows an attacker who has already compromised the renderer sandbox to break out and gain browser-process privileges. The discrepancy between CVSS 7.5 (High) and Chromium's Low severity rating likely reflects Chrome's defense-in-depth model where renderer compromise alone is considered a failed security boundary, making the subsequent escalation less critical than initial remote code execution.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately through Chrome's built-in updater (Settings → About Chrome) or download from google.com/chrome. Enterprise administrators should deploy version 148.0.7778.96 via managed update policies. Official stable channel update announcement at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html confirms fix availability. If immediate patching is infeasible, compensating controls include: Disable Cast functionality via Chrome policy ExtensionInstallBlocklist (impacts legitimate casting use cases); deploy Chrome with --disable-features=MediaRouter flag (breaks all Cast/media routing features); restrict Chrome usage to isolated networks without Chromecast devices (reduces attack surface but doesn't eliminate risk since vulnerability is in input validation, not Cast protocol itself). Note these workarounds significantly degrade functionality and should only be temporary measures pending patch deployment.