What is the CVSS score of EUVD-2026-28121?

EUVD-2026-28121 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-28121?

Yes, a patch is available for EUVD-2026-28121. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-28121

| CVE-2026-8009 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Authentication Bypass Google

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

4.2 MEDIUM

Crafted HTML page delivered over network justifies AV:N; prior renderer compromise warrants AC:H; navigation bypass yields partial C/I with no identified availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

4.6 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:33 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

5.0 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 5.0

DescriptionCVE.org

Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's Cast subsystem (all versions prior to 148.0.7778.96) enables a remote attacker who has already compromised the renderer process to escape browser-enforced navigation controls via a crafted HTML page. This is a chained exploit component - not an independent entry point - requiring prior renderer-level compromise, which substantially narrows the realistic threat pool. No public exploit code has been identified, EPSS sits at 0.03% (9th percentile), and CISA has not listed this in the Known Exploited Vulnerabilities catalog.

Technical ContextAI

The vulnerability resides in Chrome's Cast implementation - the subsystem responsible for enabling screen casting to external devices such as Chromecast receivers. CWE-693 (Protection Mechanism Failure) identifies the root cause as an inappropriate implementation that fails to correctly enforce navigation security boundaries within the Cast code path. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all platform variants of Chrome. Chrome's multi-process architecture is designed so that a compromised renderer is sandboxed and cannot freely navigate to restricted origins; a flaw in the Cast component undermines this containment by providing a code path through which navigation restrictions can be bypassed, extending the effective reach of an already-compromised renderer process.

RemediationAI

The primary remediation is upgrading Google Chrome to version 148.0.7778.96 or later, as released in the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Red Hat and SUSE users should monitor their distribution errata channels for downstream Chromium package updates. As a compensating control where immediate patching is not feasible, disabling Chrome's Cast feature via enterprise policy (ChromeCastEnabled=false in Chrome policy) removes the vulnerable code path entirely; the trade-off is loss of Chromecast and screen-casting functionality for all managed users. No other targeted workarounds have been identified in available data. Enterprise deployments managing Chrome via Google Admin Console or policy templates should prioritize pushing the 148.0.7778.96 update centrally.