What is the CVSS score of EUVD-2026-28057?

EUVD-2026-28057 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-28057?

Yes, a patch is available for EUVD-2026-28057. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-28057

| CVE-2026-7977 MEDIUM

Improper Privilege Management (CWE-269)

2026-05-06 Chrome

Privilege Escalation Google

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

SOP bypass crosses origin boundary, warranting S:C; no availability impact described; UI:R reflects mandatory victim page visit.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:39 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

6.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:12 nvd

MEDIUM 6.3

DescriptionCVE.org

Inappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Canvas implementation allows a remote, unauthenticated attacker to cross origin boundaries by inducing a victim to visit a crafted HTML page. All Chrome versions prior to 148.0.7778.96 are affected. No public exploit exists and CISA KEV confirms no active exploitation, but the SOP bypass primitive could enable partial data exfiltration from other browser origins, making it a meaningful integrity and confidentiality concern for users of unpatched versions.

Technical ContextAI

The vulnerability resides in the HTML Canvas implementation within Google Chrome's renderer (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The Canvas API is a browser 2D/WebGL drawing surface that can read pixel data across document origins if misconfigured, making it a historically sensitive SOP enforcement point. The root cause is classified as CWE-269 (Improper Privilege Management), indicating that the Canvas implementation incorrectly elevated or assigned cross-origin access rights during rendering, bypassing the isolation that the Same-Origin Policy is designed to enforce between web origins. This class of flaw is distinct from a typical parser confusion or memory corruption bug - it reflects a logic error in how origin checks are applied or enforced within the Canvas pipeline.

RemediationAI

Upgrade to Google Chrome 148.0.7778.96 or later, which contains the vendor-released patch. The stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html details the release. Users on Red Hat or SUSE Linux should apply the upstream Chromium package update when available through their distribution channels. If immediate patching is not possible, a compensating control is to enforce strict Content Security Policy (CSP) headers on sensitive internal web applications using the canvas-src directive to restrict Canvas data access, though this mitigates exposure on the server side rather than fixing the client. Disabling JavaScript in the browser would prevent exploitation entirely but renders most web applications non-functional. Browser isolation products (e.g., enterprise remote browser isolation) would neutralize this class of SOP bypass by rendering untrusted pages in a separate process context.