What is the CVSS score of EUVD-2026-28107?

EUVD-2026-28107 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-28107?

Google Chrome on macOS contains a remote code execution vulnerability (CVE-2026-8002, CVSS 8.8) in the Audio subsystem that allows attackers to execute arbitrary code through malicious webpages,…. A patch is available.

How to fix or mitigate EUVD-2026-28107?

Within 24 hours: Identify and inventory all macOS endpoints running Chrome versions prior to 148.0.7778.96 using endpoint management tools. Within 7 days: Deploy Chrome 148.0.7778.96 or later to all affected macOS systems via auto-update mechanism or manual distribution; verify completion through vulnerability scanning. Within 30 days: Conduct post-patch validation and review browser security policies (restrict installation of unverified extensions, disable plugins where unused).

Google Chrome EUVD-2026-28107

| CVE-2026-8002 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Google Red Hat Suse Chrome

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:36 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.8 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome on macOS versions prior to 148.0.7778.96 enables attackers to execute arbitrary code within the browser's sandbox through a malicious HTML page exploiting a use-after-free vulnerability in the Audio subsystem. The vulnerability requires user interaction (visiting a crafted webpage) but no authentication, with CVSS 8.8 rating reflecting high impact across confidentiality, integrity, and availability. Google has released patches in Chrome 148.0.7778.96; no active exploitation (KEV) or public POC has been identified at time of analysis, though the technical details are publicly accessible via Chromium issue tracker 495779613.

Technical ContextAI

This is a use-after-free (CWE-416) memory corruption vulnerability in Chrome's Audio subsystem, specific to the macOS implementation. Use-after-free occurs when code attempts to access memory that has already been deallocated, allowing attackers to manipulate freed memory objects to redirect program execution flow. The vulnerability affects cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to version 148.0.7778.96 on macOS platforms. Chrome's sandbox architecture is designed to contain exploits within restricted processes, limiting access to system resources even after successful code execution. This particular flaw exists in audio processing code paths that handle media elements in web content, making it triggerable through crafted HTML pages containing specific audio manipulation sequences. The platform-specific nature (macOS only) suggests the vulnerable code resides in platform-dependent audio backend implementations rather than cross-platform WebAudio API layers.

RemediationAI

Update Google Chrome on macOS to version 148.0.7778.96 or later immediately, as released in Google's May 2026 stable channel update (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html). Chrome's auto-update mechanism typically deploys this automatically; verify version in chrome://settings/help. For enterprise environments using managed Chrome deployments, push version 148.0.7778.96 through administrative update policies. No workarounds fully mitigate the risk, but temporary compensating controls include: disabling JavaScript for untrusted sites via content settings (chrome://settings/content/javascript), which prevents execution of crafted HTML audio manipulation code but severely impacts web functionality; implementing browser isolation solutions that render untrusted content in disposable virtual environments; or restricting users to curated allow-lists of trusted domains until patching completes. These workarounds carry significant usability penalties and should only be considered for air-gapped or update-restricted systems during the patching window.