cve 2026 7940

CVE-2026-7940 is a medium-severity Chromium vulnerability in the V8 JavaScript engine, disclosed by Google and Microsoft on May 6, 2026. It affects Google Chrome before version 148.0.7778.96 and allows a malicious Chrome extension to execute arbitrary code inside the browser sandbox. The risk is not from simply visiting a malicious page but requires user trust in an extension, making enterprise extension policy and treating extensions as software critical for mitigation. This tag covers discussions on the vulnerability's impact, patching, and enterprise security strategies to block malicious extensions.