CVE-2026-7899General(apple / chrome)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apple chrome systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

apple CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html

Other references

https://issues.chromium.org/issues/505481948

Weakness type (CWE)

CWE-125CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome
linux_kernel
macos
windows

Threat summary

Patch or workaround signal is available
7 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
General: 3 classified signals
Disclosure: 2 classified signals
Peaked 5d ago at 2 mentions (2026-05-07); latest day: 1
7 total mentions across 6 days

Affected systems

Vendors

apple google linux microsoft

Products

chromelinux_kernelmacoswindows

1 version affected across 4 products

Deep dive

Activity timeline7 mentions / 6d

Signal classification3 categories

General

350.0%

Disclosure

233.3%

Patch

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-07	2	Disclosure2
2026-05-08	1	General1
2026-05-14	1	Patch1
2026-08-28	1	General1
2026-08-29	1	General1

Full discourse7 posts

Nebula Security@nebusecurity153d
General
Yesterday we dropped our latest write-up on a previous Chrome 0-day. Today we got assigned yet another Chrome 0-day: CVE-2026-7899 — along with a $55,000 bounty from Google If you haven’t read yesterday’s blog yet, go check it out down below. It’s a fun one. Now it’s time for us to prepare the next few write-ups. A Chrome RCE and a Linux kernel local privilege escalation. Stay tuned 👀 https://nebusec.ai/research/v8-maglev-incorrect-phis-untagging/?v=0
Post summary
The post announces a new Chrome 0‑day CVE and references a prior write-up, but provides no technical details, PoC, exploit code, or evidence of active exploitation.
236026616622.8K
5.5K followersView on X
Nebula Security@nebusecurity42d
General
https://nebusec.ai/research/v8-turboshaft-wasm-phiop-cve-2026-7899/
Post summary
The provided URL references a CVE but includes no additional details or claims, resulting in a low‑confidence general classification.
06020163.5K
7.2K followersView on X
xia0o0o0o@Nyaaaaa_ovo40d
General
cve-2026-7899 btw
Post summary
The excerpt only references the CVE identifier without providing any additional information.
1002573.2K
3.5K followersView on X
Tim Queen@iamtimqueen6d
@moyix You are getting this all wrong Brendan. Anthropic does this to protect everyone from the model. Just imagine an all-powerful, super-intelligent model learning how to apply CVE-2026-7899, it might use this knowledge to break out of its sandbox and escape. 😁
00030145
1.6K followersView on X
CVE@CVEnew154d
Disclosure
CVE-2026-7899 Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.… https://www.cve.org/CVERecord?id=CVE-2026-7899
Post summary
The message announces CVE-2026-7899, detailing an out‑of‑bounds read/write bug in Chrome's V8 that allows arbitrary code execution via a crafted HTML page, without mentioning PoC, exploit code, or patches.
00021179
57.7K followersView on X
iototsecnews@iototsecnews148d
Patch
Google Chrome 148 がリリース：3件の Critical を含む 127 件の脆弱性を修正 https://iototsecnews.jp/2026/05/07/google-chrome-148-released-with-fix-for-127-security-vulnerabilities-update-now/ 今回のアップデートでは、メモリの管理不備が引き起こす、多くの脆弱性が修正されています。脆弱性 CVE-2026-7897／ CVE-2026-7898／CVE-2026-7901 などに見られる解放後メモリ使用の問題は、一度解放されたはずのメモリ領域に、プログラムが再アクセスすることで発生します。また、 CVE-2026-7896 のような整数オーバーフローや、 CVE-2026-7899 などの境界外読み取り／書き込みといった問題は、データのサイズ確認やアクセス範囲の制限が不十分なことで発生します。 V8 エンジンや ANGLE といった複雑な仕組みの中で、オブジェクトの寿命やデータの境界を正確に制御することの難しさが、これらの脆弱性につながっています。ご利用のチームは、ご注意ください。 #Chrome #Google #Vulnerability
Post summary
Google Chrome 148 has been released, addressing 127 critical vulnerabilities—primarily memory management, integer overflow, and out‑of‑bounds read/write issues—providing patches for the named CVEs.
01000146
491 followersView on X
Infoflowcloud@infoflowcloud154d
Disclosure
🚨*CVE* CVE-2026-7899 Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.… https://www.cve.org/CVERecord?id=CVE-2026-7899 ----- Traducción: CVE-2026-7899 Lec… http://infoflow.cloud`
Post summary
The tweet announces the discovery of CVE-2026-7899, detailing an out‑of‑bounds read/write flaw in Chrome’s V8 engine that allows remote code execution via crafted HTML.
0000048
75 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	macos	-	-	-
App	google	chrome	-	-	-
OS	linux	linux_kernel	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard apple CVEs google CVEs linux CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-7899

Nebula Security[verified]@nebusecurityGeneral

The post announces a new Chrome 0‑day CVE and references a prior write-up, but provides no technical details, PoC, exploit code, or evidence of active exploitation.

Nebula Security[verified]@nebusecurityGeneral

The provided URL references a CVE but includes no additional details or claims, resulting in a low‑confidence general classification.

xia0o0o0o@Nyaaaaa_ovoGeneral

The excerpt only references the CVE identifier without providing any additional information.

CVE@CVEnewDisclosure

The message announces CVE-2026-7899, detailing an out‑of‑bounds read/write bug in Chrome's V8 that allows arbitrary code execution via a crafted HTML page, without mentioning PoC, exploit code, or patches.

iototsecnews@iototsecnewsPatch

Google Chrome 148 has been released, addressing 127 critical vulnerabilities—primarily memory management, integer overflow, and out‑of‑bounds read/write issues—providing patches for the named CVEs.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces the discovery of CVE-2026-7899, detailing an out‑of‑bounds read/write flaw in Chrome’s V8 engine that allows remote code execution via crafted HTML.