What is the CVSS score of EUVD-2026-27977?

EUVD-2026-27977 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-27977?

Yes, a patch is available for EUVD-2026-27977. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-27977

| CVE-2026-7937 LOW

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Authentication Bypass Google Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:41 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

3.1 (LOW)

CVE Published

May 06, 2026 - 18:12 nvd

LOW 3.1

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Chrome DevTools prior to version 148.0.7778.96 allows attackers to bypass navigation restrictions through a malicious extension, requiring user installation and interaction. The vulnerability has a low CVSS score (3.1) due to high attack complexity and user interaction requirements, resulting in limited confidentiality impact with no integrity or availability effects. Patch is available from Google.

Technical ContextAI

The vulnerability exists in Chrome's DevTools policy enforcement mechanism, which is responsible for restricting navigation and extension capabilities. The root cause is classified as CWE-693 (Protection Mechanism Failure), indicating that the intended safeguards against extension-based navigation bypasses are insufficient. The issue arises when DevTools fails to properly validate or enforce policies that should prevent extensions from circumventing normal navigation restrictions. This is not a memory corruption or injection vulnerability but rather an authorization/policy logic flaw where an extension with user consent can access restricted DevTools APIs or features that normally require elevated permissions or special handling.

RemediationAI

Vendor-released patch: Google Chrome version 148.0.7778.96 or later. Users should update immediately via Chrome's built-in auto-update mechanism (Settings > About > Check for updates) or download the latest version from https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. For enterprise environments, administrators should deploy Chrome via their organization's update management system and verify rollout completion. As a compensating control, restrict extension installation policy via Chrome Enterprise policies (allowed_extensions and blocked_extensions) to only approved extensions from your organization's curated list; this reduces the attack surface by preventing users from installing untrusted extensions, though it requires user education and ongoing policy maintenance. Additionally, educate users not to install extensions from untrusted sources or unsolicited offers, though this is not a technical control and depends on user compliance.