What is the CVSS score of EUVD-2026-28139?

EUVD-2026-28139 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-28139?

Google Chrome versions prior to 148.0.7778.96 contain a sandbox escape vulnerability that could allow remote attackers to fully compromise affected systems through specially crafted network traffic,…. A patch is available.

How to fix or mitigate EUVD-2026-28139?

Within 24 hours: Inventory all Chrome deployments across the organization and identify systems running versions prior to 148.0.7778.96. Within 7 days: Deploy Chrome version 148.0.7778.96 or later to all endpoints using your standard patch management process (via Google Update, MDM, or manual installation depending on your deployment model). Within 30 days: Verify 100% deployment completion through endpoint auditing tools and confirm no legacy versions remain in active use.

Google Chrome EUVD-2026-28139

| CVE-2026-8018 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Information Disclosure Google Red Hat Suse Chrome

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

10.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 22:37 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

8.1 (HIGH)

CVE Published

May 06, 2026 - 18:13 nvd

UNKNOWN (no severity yet)

CVE Published

May 06, 2026 - 18:13 nvd

HIGH 8.1

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome prior to 148.0.7778.96 allows remote attackers to break out of Chrome's security sandbox via specially crafted network traffic targeting a policy enforcement weakness in DevTools. The vulnerability requires high attack complexity (CVSS AC:H) but no user interaction, enabling complete compromise of confidentiality, integrity, and availability if successfully exploited. Vendor patch released in Chrome 148.0.7778.96 per official Google Chrome stable channel update. Despite CVSS 8.1 (High), Chromium assigns Low security severity, suggesting limited real-world exploitability or significant attack prerequisites. No active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability affects the DevTools component of Google Chrome, which provides browser developer and debugging capabilities. The issue stems from insufficient enforcement of security policies within DevTools, creating a pathway for sandbox escape - one of Chrome's most critical security boundaries. Chrome's multi-process architecture relies on sandboxing to isolate renderer processes from the host operating system, limiting the impact of compromised web content. A sandbox escape vulnerability breaks this isolation, allowing malicious code to access system resources and user data beyond the intended security boundary. The attack vector involves malicious network traffic, suggesting the vulnerability may be triggered through network protocol handling, WebSocket connections, or remote debugging protocol interactions. The discrepancy between CVSS 8.1 (High) and Chromium's Low severity rating indicates the attack likely requires unusual conditions despite the theoretical impact severity.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later immediately via built-in auto-update (chrome://settings/help) or manual download from google.com/chrome. Enterprise deployments should push version 148.0.7778.96 through managed update channels per Google Chrome Enterprise release notes. For environments unable to patch immediately, disable remote DevTools debugging features by removing --remote-debugging-port command-line flags, blocking TCP ports 9222 and 9229 at network perimeter (default remote debugging ports), and restricting chrome://inspect access through endpoint protection policies. If DevTools remote debugging is business-critical, restrict network access to trusted IP ranges only and require VPN authentication. Note that disabling DevTools entirely may impact developer workflows but significantly reduces attack surface. Monitor Chromium bug tracker issue 498292657 for additional technical details that may inform compensating controls. Organizations using Chromium-based browsers should consult vendor advisories and apply equivalent patches when available.