CVE-2026-7939
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Risk Assessment
An attacker could execute malicious code in the user's browser context, potentially leading to session or data theft. The risk affects all users of outdated Chrome versions.
Recommendation
Update Google Chrome to version 148.0.7778.96 or later. Enforce a browser update policy across the organization.
Other vulnerabilities in Google Chrome
See all- CVE-2026-113338High
Use-after-free vulnerability in the Turbolev component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113271High
Use-after-free vulnerability in the Accessibility component of Google Chrome prior to 156.0.8078.47. A remote attacker could exploit a crafted HTML page to execute arbitrary code inside the sandbox.
- CVE-2026-113045Unknown
An out of bounds read in Offline in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.
- CVE-2026-113043High
Use after free in the iOSWeb component in Google Chrome on iOS prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-102328High
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-102327High
Incorrect authorization in WebView in Google Chrome on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-102326High
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-102325Medium
Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-102324High
Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-102323High
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Original NVD description (English source)
Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS