What is the CVSS score of EUVD-2026-27947?

EUVD-2026-27947 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-27947?

CVE-2026-7922 is a sandbox escape vulnerability in Google Chrome that allows remote attackers to execute code outside Chrome's security sandbox through a specially crafted webpage, affecting all…. A patch is available.

How to fix or mitigate EUVD-2026-27947?

Within 24 hours: Inventory all Chrome deployments and document current versions across endpoints. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all endpoints using your patch management system; prioritize user-facing devices and kiosk systems. Within 30 days: Verify 100% deployment completion through MDM/EDR reporting and conduct spot checks on random endpoints to confirm patch application.

Google Chrome EUVD-2026-27947

| CVE-2026-7922 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:26 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome via ServiceWorker use-after-free allows remote attackers to break out of Chrome's security sandbox through a specially crafted HTML page. Affects all Chrome versions prior to 148.0.7778.96. EPSS data not yet available for this recent CVE. Google has released a patch in version 148.0.7778.96. While rated high severity by Chromium project, the attack complexity is high (AC:H) and requires user interaction (UI:R), limiting widespread exploitation risk despite the critical scope change (S:C) indicating sandbox escape capability.

Technical ContextAI

This vulnerability exploits a use-after-free condition (CWE-416) in Chrome's ServiceWorker implementation. ServiceWorkers are scripts that run in the background separate from web pages, enabling offline functionality and push notifications. Use-after-free occurs when code continues to use a memory pointer after the memory has been freed, allowing attackers to manipulate freed memory and potentially execute arbitrary code. The scope change metric (S:C) in the CVSS vector indicates this vulnerability allows escape from Chrome's sandbox environment, which normally isolates web content from the underlying operating system. The affected component is specifically the ServiceWorker lifecycle management in the Chromium rendering engine, as confirmed by Chromium bug tracker issue 499449324.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via the browser's built-in update mechanism (Settings → About Chrome) or download from https://www.google.com/chrome/. Chrome typically auto-updates within 24-48 hours for most users, but manual update verification is recommended for enterprise or manually-managed installations. For environments where immediate patching is not feasible, implement compensating controls: disable ServiceWorker functionality via Chrome Enterprise policy 'ServiceWorkersAllowedForOrigins' set to empty list (note: this breaks offline web app functionality and push notifications for legitimate sites, significantly impacting user experience); deploy browser isolation solutions that virtualize browser sessions in separate containers; restrict user access to untrusted websites via web filtering and application whitelisting. For Chromium-based browsers (Edge, Brave, Opera), monitor respective vendor channels for equivalent security updates as they typically lag Google Chrome releases by several days to weeks.