What is the CVSS score of EUVD-2026-20748?

EUVD-2026-20748 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by EUVD-2026-20748?

Google Chrome versions prior to 147.0.7727.55 contain a type confusion vulnerability in the CSS engine that can lead to heap corruption and arbitrary code execution if users install a malicious…. A patch is available.

How to fix or mitigate EUVD-2026-20748?

Within 24 hours: Inventory Chrome deployments and identify users on versions prior to 147.0.7727.55. Within 7 days: Deploy Chrome 147.0.7727.55 or later across all affected systems via managed update mechanisms; block outdated Chrome versions via group policy or Mobile Device Management if available. Within 30 days: Implement extension management policies restricting installation to an organization-approved whitelist and review audit logs for any unauthorized extension installations during the vulnerability window.

Google EUVD-2026-20748

| CVE-2026-5914 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-04-08 Chrome

GHSA-7256-9fwc-879g

Information Disclosure Google Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

5.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20748

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:21 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Type confusion vulnerability in Google Chrome CSS engine (versions prior to 147.0.7727.55) enables heap corruption through malicious extensions. Attacker must convince user to install crafted Chrome extension, then exploit triggers memory corruption allowing high-severity impacts: arbitrary code execution, information disclosure, and denial of service. CVSS 8.8 rating reflects unauthenticated network vector requiring only user interaction. No public exploit identified at time of analysis. Chromium project classifies severity as Low despite critical CVSS score, indicating successful exploitation barriers beyond user interaction.

Technical ContextAI

CWE-843 type confusion in Chromium CSS parsing subsystem causes improper type casting during extension-triggered rendering operations. Heap metadata corruption occurs when extension-supplied CSS constructs bypass type validation, allowing attacker-controlled object reinterpretation. CPE a:google:chrome confirms client-side browser component vulnerability, not server-side. Root cause isolated to CSS engine's interaction with Chrome Extension API privilege model.

RemediationAI

Vendor-released patch: Google Chrome 147.0.7727.55. Users must upgrade immediately via Chrome's built-in update mechanism (Settings > About Chrome) or download from official channels. Enterprise deployments should push update via managed policies. Workaround prior to patching: disable installation of unverified Chrome extensions via enterprise policy ExtensionInstallBlocklist or user-level restriction of extension permissions. Review installed extensions, remove untrusted sources. Advisory: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html. Technical details: https://issues.chromium.org/issues/490023239. No other mitigation eliminates risk while running vulnerable versions with extension capabilities enabled.