What is the CVSS score of EUVD-2026-28100?

EUVD-2026-28100 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-28100?

Yes, a patch is available for EUVD-2026-28100. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-28100

| CVE-2026-7998 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

4.2 MEDIUM

AC:H reflects mandatory prior renderer compromise; UI spoofing warrants I:L; no availability impact from dialog spoofing alone.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

3.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:35 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.4 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 5.4

DescriptionCVE.org

Insufficient validation of untrusted input in Dialog in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Dialog component prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to deceive users with falsified browser UI elements via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input (CWE-20) in Dialog handling, enabling manipulation of how dialog boxes are rendered. No public exploit or active exploitation has been identified; EPSS is 0.05% and SSVC classifies exploitation as none, placing real-world urgency well below what the moderate CVSS score alone might suggest.

Technical ContextAI

The flaw resides in Chrome's Dialog subsystem, a browser UI layer responsible for rendering native-style dialog boxes (alerts, confirms, prompts) surfaced to users. CWE-20 (Improper Input Validation) indicates that input originating from the renderer process - which handles untrusted web content - is not adequately sanitized before being acted upon by the browser's privileged UI layer. Chrome's multi-process architecture uses sandboxed renderer processes to isolate web content; this vulnerability is exploitable only after that sandbox has already been breached, meaning it functions as a post-compromise UI escalation primitive rather than an initial access vector. Affected scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 148.0.7778.96. Tags referencing Red Hat and SUSE indicate downstream Linux distribution packaging concerns alongside the upstream Chrome release.

RemediationAI

The primary fix is upgrading Google Chrome to version 148.0.7778.96 or later, which is confirmed available from the vendor per the stable channel update at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this for most desktop users automatically. Red Hat and SUSE users should apply the patched Chromium packages when issued by their respective distribution security teams. No meaningful standalone workaround exists for this flaw given it operates within the browser's Dialog subsystem; however, because exploitation requires prior renderer compromise, organizations that enforce strict browser sandboxing hardening (e.g., enabling Chrome's strict site isolation policy) reduce the probability of reaching the precondition for this vulnerability. Patching the renderer-level vulnerability that would enable the prerequisite compromise is independently advisable.