What is the CVSS score of EUVD-2026-27989?

EUVD-2026-27989 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-27989?

Yes, a patch is available for EUVD-2026-27989. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-27989

| CVE-2026-7943 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:42 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.2 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 4.2

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to perform arbitrary memory read and write operations via a crafted HTML page. The vulnerability requires renderer process compromise as a precondition, user interaction, and high attack complexity, making it a post-exploitation vector rather than a primary attack surface. Patch is available from vendor.

Technical ContextAI

ANGLE is Google's abstraction layer for graphics APIs used by Chrome to interface with underlying graphics hardware (DirectX, OpenGL, Vulkan). CWE-20 (Improper Input Validation) indicates the vulnerability stems from insufficient validation of untrusted input passed to ANGLE functions, likely during shader compilation, texture handling, or other graphics command processing. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U indicates network attack vector but with high complexity and user interaction requirements, consistent with requiring renderer process compromise first and user navigation to a malicious page. CPE cpe:2.3:a:google:chrome indicates all Chrome variants are affected up to 148.0.7778.96.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, which contains the vendor-released patch addressing the ANGLE input validation issue. Users on Windows, macOS, and Linux can enable automatic updates or manually download the latest version from google.com/chrome. For enterprise deployments using Chrome policies, administrators should push version 148.0.7778.96 or later through their update mechanisms. No explicit workarounds are available for this vulnerability; patching is the required remediation. The patch should be applied promptly as it is available from the vendor, though the moderate CVSS and high exploitation complexity mean this is not a critical emergency in most environments. Refer to the Chrome security release advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and https://issues.chromium.org/issues/495373657 for technical details and rollout schedule.