What is the CVSS score of EUVD-2026-28029?

EUVD-2026-28029 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-28029?

Google Chrome versions before 148.0.7778.96 contain a sandbox escape vulnerability that allows attackers who have compromised the browser's renderer process to gain full system access through…. A patch is available.

How to fix or mitigate EUVD-2026-28029?

Within 24 hours: Inventory Chrome deployments and identify version status across endpoints using your mobile device management or endpoint detection and response platform. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all user endpoints via your patch management system; enforce automatic updates if not already enabled. Within 30 days: Conduct audit of renderer process compromises in your environment and verify no suspicious ServiceWorker registration patterns exist in Chrome user profiles.

Google Chrome EUVD-2026-28029

| CVE-2026-7963 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:30 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.3 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 8.3

DescriptionCVE.org

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.96 allows remote attackers who have already compromised the renderer process to break out of Chrome's security sandbox via crafted HTML pages exploiting ServiceWorker implementation flaws. This vulnerability requires high attack complexity and user interaction but enables complete system compromise once the initial renderer compromise is achieved. Vendor patch released in Chrome 148.0.7778.96 per official Chrome security bulletin.

Technical ContextAI

ServiceWorkers are JavaScript workers that run in the background of web applications, handling network requests, caching, and push notifications independently of web pages. Chrome's security architecture uses multi-process sandboxing where renderer processes (handling web content) operate with restricted privileges, isolated from the main browser process and operating system. This vulnerability (CWE-693: Protection Mechanism Failure) exists in the ServiceWorker implementation within the renderer process, creating a pathway to escape the sandbox boundary. The inappropriate implementation allows an attacker who has already achieved code execution in a sandboxed renderer process-typically through a separate memory corruption or logic vulnerability-to leverage ServiceWorker functionality to break containment and execute code outside the sandbox with elevated privileges. The affected product per CPE data is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically all versions before 148.0.7778.96.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via Chrome's built-in updater (Settings → About Chrome) or through enterprise deployment tools for managed environments. Chrome typically auto-updates within 24-48 hours for consumer installations, but organizations should force-push this update through group policy or mobile device management systems given the sandbox escape nature. Official vendor advisory and update available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. No workarounds are provided by Google; the patch is the only complete remediation. For air-gapped or update-restricted environments where immediate patching is impossible, implement strict application whitelisting to prevent Chrome execution, enforce browser isolation technologies (remote browser isolation services), or restrict Chrome usage to non-sensitive operations until patching is feasible-though these compensating controls significantly degrade functionality and should be temporary measures only.