What is the CVSS score of EUVD-2026-28007?

EUVD-2026-28007 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-28007?

Yes, a patch is available for EUVD-2026-28007. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-28007

| CVE-2026-7952 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Authentication Bypass Google Red Hat Suse Chrome

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:42 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.2 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 4.2

DescriptionCVE.org

Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Chrome Extensions prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to bypass discretionary access controls via a crafted HTML page, potentially leading to unauthorized information disclosure or modification. The vulnerability requires user interaction and a pre-existing renderer compromise, limiting its practical exploitation scope. A vendor-released patch is available in Chrome 148.0.7778.96 and later.

Technical ContextAI

This vulnerability stems from CWE-693 (Protection Mechanism Failure), specifically inadequate policy enforcement within Chrome's extension sandboxing architecture. Chrome Extensions operate within a restricted security context, and this flaw allows an attacker who has already gained code execution in the renderer process (the browser's HTML/JavaScript execution environment) to circumvent the discretionary access controls that normally isolate extension permissions and capabilities. The renderer process is typically compromised through a separate renderer vulnerability; this CVE exploits insufficient policy validation after that initial breach. The attack surface involves crafted HTML payloads that trigger the policy bypass when processed by a compromised renderer.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately. Chrome's auto-update mechanism will deliver this patch automatically on most systems; users can manually check for updates by navigating to Chrome Menu → About Google Chrome, which will force a check and apply any pending updates. No workarounds for pre-patch versions are available, as the vulnerability is embedded in the extension policy enforcement layer. Administrators managing Chrome via enterprise policies should verify that Chrome auto-updates are enabled and monitor deployment to ensure all instances are updated within 24-48 hours of patch availability. The patch addresses the underlying policy enforcement gap; no configuration changes or feature disabling is necessary post-patch.