What is the CVSS score of EUVD-2026-27937?

EUVD-2026-27937 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-27937?

CVE-2026-7917 is a sandbox escape vulnerability in Google Chrome on Windows that allows attackers to elevate privileges after compromising the renderer process, potentially enabling full system…. A patch is available.

How to fix or mitigate EUVD-2026-27937?

Within 24 hours: Inventory all Windows systems running Google Chrome and document current versions. Within 7 days: Deploy Chrome version 148.0.7778.96 or later via your endpoint management system; prioritize systems in high-risk roles (developers, researchers, security teams). Within 30 days: Verify 100% deployment completion and confirm no systems remain on versions prior to 148.0.7778.96; audit Chrome security policies to restrict renderer process execution where feasible.

Google Chrome EUVD-2026-27937

| CVE-2026-7917 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Microsoft Use After Free Memory Corruption Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:25 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Fullscreen in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows allows attackers who have already compromised the renderer process to break out of Chrome's security sandbox via a use-after-free flaw in the Fullscreen API. Affects Chrome versions prior to 148.0.7778.96 on Windows platforms. Google has released a patch (version 148.0.7778.96) and rated this High severity. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code at time of analysis, though the vulnerability requires initial renderer compromise making it a second-stage exploitation vector.

Technical ContextAI

This is a use-after-free (CWE-416) memory corruption vulnerability in Chrome's Fullscreen API implementation on Windows. Use-after-free occurs when code continues to use a memory pointer after the memory has been freed, allowing attackers to manipulate program execution by controlling the freed memory's contents. The vulnerability exists specifically in the fullscreen handling code path on Windows builds of Chrome (CPE: cpe:2.3:a:google:chrome). Chrome's multi-process architecture employs sandbox isolation to contain compromised renderer processes, but this vulnerability allows escape from that critical security boundary. The Changed scope (S:C) in the CVSS vector confirms the sandbox escape capability, as the vulnerability impacts resources beyond the vulnerable component's security scope.

RemediationAI

Update Google Chrome for Windows to version 148.0.7778.96 or later immediately. Chrome typically auto-updates within 24-48 hours, but administrators should force updates via chrome://settings/help or enterprise policies for managed deployments. Google's stable channel update announcement at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html contains official patch information. Technical details in Chromium issue tracker at https://issues.chromium.org/issues/498752242 may be access-restricted until patch deployment is widespread. If immediate patching is impossible, compensating controls include: disable fullscreen API via enterprise policy ExtensionInstallForcelist to block fullscreen requests (impacts user experience for legitimate fullscreen content like videos); deploy Chrome in application virtualization or sandbox solutions like Windows Defender Application Guard to add additional containment layers (performance overhead 15-30%); restrict Chrome usage to low-privilege user accounts on Windows to limit post-exploitation impact (does not prevent sandbox escape but limits lateral movement). These mitigations significantly degrade user experience and should only be temporary measures.