Description
Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
Published: 2026-05-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in the V8 JavaScript engine that allows an attacker to craft a malicious Chrome extension. When the user installs and runs the extension, the flaw enables the attacker to execute arbitrary code inside Chrome’s sandbox. This flaw is identified as CWE‑416.

Affected Systems

Google Chrome versions earlier than 148.0.7778.96 are affected. The issue is specific to the Desktop Chrome stable channel and applies to all platforms where that version is installed.

Risk and Exploitability

The flaw was assigned Chromium security severity Medium, but the CVSS score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires social engineering to convince a user to install a malicious extension; once the extension is installed the code runs with sandboxed privileges. The risk is mitigated by applying the Chrome patch and by restricting the installation of extensions.

Generated by OpenCVE AI on May 7, 2026 at 01:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome 148.0.7778.96 or later
  • Revoke or uninstall any suspicious or unknown extensions
  • Disable or restrict extensions via Chrome policy or settings to prevent installation of untrusted extensions

Generated by OpenCVE AI on May 7, 2026 at 01:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6250-1 chromium security update
History

Thu, 07 May 2026 01:30:00 +0000

Type Values Removed Values Added
Title Use-after-Free in V8 Allows Arbitrary Code Execution via Malicious Chrome Extension

Wed, 06 May 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Wed, 06 May 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 06 May 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Wed, 06 May 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 06 May 2026 20:00:00 +0000

Type Values Removed Values Added
Title Use-after-Free in V8 Allows Arbitrary Code Execution via Malicious Chrome Extension

Wed, 06 May 2026 18:30:00 +0000

Type Values Removed Values Added
Description Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-07T03:56:23.189Z

Reserved: 2026-05-05T22:59:15.321Z

Link: CVE-2026-7940

cve-icon Vulnrichment

Updated: 2026-05-06T19:46:04.976Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-06T19:16:42.323

Modified: 2026-05-06T23:33:48.200

Link: CVE-2026-7940

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-07T01:15:17Z

Weaknesses