What is the CVSS score of EUVD-2026-28015?

EUVD-2026-28015 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-28015?

Google Chrome versions prior to 148.0.7778.96 contain a sandbox escape vulnerability that allows attackers who have already compromised the browser's renderer process to gain system-level access.. A patch is available.

How to fix or mitigate EUVD-2026-28015?

Within 24 hours: Enable Chrome auto-update or manually verify all Chrome installations are at version 148.0.7778.96 or later; communicate mandatory patch requirement to all users via MDM/endpoint management if available. Within 7 days: Audit Chrome deployment across the organization using endpoint detection tools; prioritize systems with elevated privileges or sensitive data access. Within 30 days: Verify 100% compliance with Chrome 148.0.7778.96+ through automated compliance scanning; document remediation in vulnerability management system.

Google Chrome EUVD-2026-28015

| CVE-2026-7956 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Google Denial Of Service Use After Free Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:30 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome prior to 148.0.7778.96 allows remote attackers who have already compromised the renderer process to break out of Chrome's security sandbox via a use-after-free vulnerability in the Navigation component. This requires user interaction with a malicious HTML page and successful renderer compromise as a prerequisite, making it a two-stage attack requiring high attack complexity. Vendor-released patch available in Chrome 148.0.7778.96. No public exploit or active exploitation (CISA KEV) identified at time of analysis. CVSS 8.3 (High) reflects the severe post-compromise impact (sandbox escape enabling system-level access), but real-world risk depends heavily on successful initial renderer compromise.

Technical ContextAI

This vulnerability involves a use-after-free condition (CWE-416) in Chrome's Navigation component, which manages page transitions, history, and frame navigation. Use-after-free occurs when code continues to use a memory pointer after the referenced object has been deallocated, leading to memory corruption. In Chrome's multi-process architecture, the renderer process runs in a restrictive sandbox to isolate web content from the operating system. This vulnerability enables sandbox escape - attackers who have already exploited a separate vulnerability to compromise the renderer can leverage this UAF to execute code outside the sandbox with elevated privileges. The CVSS scope change (S:C) reflects this privilege boundary crossing from sandboxed renderer to browser/system context. Affected product per CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions prior to 148.0.7778.96.

RemediationAI

Update Google Chrome immediately to version 148.0.7778.96 or later via the browser's built-in update mechanism (Settings > About Chrome triggers automatic update). Enterprise deployments should push version 148.0.7778.96 through managed update channels per Google's enterprise release notes at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome typically auto-updates within 24-48 hours of release, but users should manually verify update completion and restart the browser to apply patches. For environments unable to immediately patch, interim compensating controls include: disabling JavaScript on untrusted sites via Site Settings (reduces renderer compromise vectors but severely impacts functionality - not practical for most users), using Chrome's Enhanced Safe Browsing mode to block known malicious sites (Settings > Privacy and Security), and restricting browsing to trusted domains via enterprise policies like URLBlocklist/URLAllowlist. These workarounds only reduce initial renderer compromise risk and do not address the underlying sandbox escape vulnerability. No other effective mitigation exists - patching to 148.0.7778.96+ is the only complete remediation.