What is the CVSS score of EUVD-2026-27901?

EUVD-2026-27901 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-27901?

CVE-2026-7899 is a critical remote code execution vulnerability in Google Chrome's V8 engine that allows attackers to execute arbitrary code within the browser sandbox through malicious webpages.. A patch is available.

How to fix or mitigate EUVD-2026-27901?

Within 24 hours: Inventory all Chrome installations across Windows, macOS, and Linux endpoints using your MDM or asset management tools and identify versions below 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via your software distribution mechanism (WSUS, SCCM, Jamf, or equivalent) with mandatory restart policies. Within 30 days: Validate 100% deployment completion through endpoint telemetry; confirm no systems remain on vulnerable versions and document remediation evidence for audit.

Google Chrome EUVD-2026-27901

| CVE-2026-7899 HIGH

Out-of-bounds Read (CWE-125)

2026-05-06 Chrome

Google Information Disclosure RCE Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 00:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory access in Chrome's V8 JavaScript engine enables remote code execution within the browser sandbox when users visit malicious websites. Affects all Chrome versions prior to 148.0.7778.96 across Windows, macOS, and Linux. Google released patches in the stable channel update (build 148.0.7778.96) per May 2026 advisory. No active exploitation confirmed at time of analysis, but CVSS 8.8 indicates high severity and the vulnerability requires only user interaction (visiting a crafted webpage) with no authentication needed.

Technical ContextAI

This vulnerability resides in V8, Google's open-source JavaScript and WebAssembly engine that powers Chrome and Chromium-based browsers. The flaw is classified as CWE-125 (Out-of-bounds Read) but also involves out-of-bounds write capability according to the description, enabling both information disclosure and memory corruption. V8 performs just-in-time (JIT) compilation of JavaScript, and memory safety bugs in this component can allow attackers to escape normal JavaScript security boundaries. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects the Chrome application suite. While exploitation occurs within Chrome's sandbox (a defense-in-depth layer that isolates renderer processes), arbitrary code execution in the sandbox is the first stage of browser exploitation chains and can be combined with sandbox escape vulnerabilities.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later via the stable channel release published May 2026. Chrome's auto-update mechanism deploys patches automatically for most users within 24-48 hours; administrators can verify versions at chrome://settings/help and force immediate update checks. Enterprise deployments using managed Chrome policies should prioritize distribution of build 148.0.7778.96 through update channels (reference: chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html). For environments unable to immediately patch, implement compensating controls: disable JavaScript execution for untrusted sites via Chrome's site settings (reduces functionality significantly for modern web applications), deploy Enhanced Safe Browsing mode to block known malicious sites, and utilize network-level filtering to restrict browser access to only approved domains (creates substantial operational overhead for general-purpose browsing). Chromium-based browser users should monitor their respective vendor advisories (Microsoft Edge Security Updates, Brave release notes) for equivalent patches incorporating the V8 fix.