What is the CVSS score of EUVD-2026-27955?

EUVD-2026-27955 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-27955?

Google Chrome versions prior to 148.0.7778.96 contain a remote code execution vulnerability in the Presentation API that allows attackers to execute arbitrary code within the browser sandbox when…. A patch is available.

How to fix or mitigate EUVD-2026-27955?

Within 24 hours: verify current Chrome versions across all endpoints and communicate mandatory update requirement to users. Within 7 days: deploy Chrome 148.0.7778.96 or later via your organization's patch management system; enforce automatic updates where policy permits. Within 30 days: audit deployment logs to confirm 100% remediation and document compliance for governance records.

Google Chrome EUVD-2026-27955

| CVE-2026-7926 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:27 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome prior to version 148.0.7778.96 allows attackers to execute arbitrary code within the browser's sandbox by exploiting a use-after-free vulnerability in the Presentation API through a specially crafted HTML page. User interaction is required (visiting a malicious webpage). EPSS data not available for this recent CVE. No public exploit confirmed at time of analysis, though the vulnerability has been patched by Google in the stable channel release.

Technical ContextAI

This vulnerability affects the Presentation API implementation in Chromium-based Google Chrome browsers (CPE: cpe:2.3:a:google:chrome). The Presentation API allows web applications to display content on secondary screens or devices. The underlying flaw is a use-after-free condition (CWE-416), a memory corruption vulnerability where the browser attempts to access memory after it has been freed. This class of vulnerability occurs when pointer references are not properly invalidated after memory deallocation, allowing attackers to manipulate freed memory regions. In browser contexts, use-after-free bugs are particularly dangerous because they can be triggered through JavaScript and DOM manipulation in crafted web pages, potentially bypassing memory safety protections to achieve code execution within the renderer process sandbox.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via the browser's built-in update mechanism (Settings > About Chrome) or by downloading the latest version from google.com/chrome. Chrome typically auto-updates within 24-48 hours of release, but manual update ensures immediate protection. For enterprise environments using managed deployments, push version 148.0.7778.96 through existing update channels. Until patching is complete, organizations can reduce exposure by implementing strict web filtering to block access to untrusted sites, though this is impractical for most users. Disabling the Presentation API via enterprise policy (if available) would eliminate the attack surface but breaks legitimate functionality for users relying on multi-screen presentations. No effective workaround exists for individual users beyond avoiding untrusted web content until the update is applied.