What is the CVSS score of CVE-2026-9111?

CVE-2026-9111 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9111?

Google Chrome for Linux before version 148.0.7778.179 contains a remote code execution vulnerability enabling attackers to compromise systems through malicious web pages, affecting all unpatched…. A patch is available.

How to fix or mitigate CVE-2026-9111?

Within 24 hours: Identify all Linux systems running Chrome and assess whether automated patch deployment is available for your environment. Within 7 days: Deploy Chrome 148.0.7778.179 or later to all affected systems; prioritize systems accessing sensitive data or networks. Within 30 days: Validate patch coverage through vulnerability scanning and verify no systems remain unpatched.

Google Chrome CVE-2026-9111

EUVD-2026-31160 HIGH

Use After Free (CWE-416)

2026-05-20 Chrome

GHSA-6r32-h5rg-9m59

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:32 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on Linux before 148.0.7778.179 stems from a use-after-free flaw in the WebRTC component, allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code in the renderer process. Chromium rates the severity as Critical and a vendor patch is available, though there is no public exploit identified at time of analysis and SSVC indicates no observed exploitation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with required user interaction (visiting a page).

Technical ContextAI

The vulnerability resides in WebRTC, the real-time communication stack built into Chromium that handles peer-to-peer audio, video, and data channels through components like PeerConnection, RTP/RTCP processing, and SDP negotiation. CWE-416 (Use-After-Free) means the code continues to reference memory after it has been freed, allowing an attacker who can influence subsequent allocations to place controlled data where a dangling pointer is dereferenced, typically leading to type confusion or arbitrary write primitives suitable for code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scopes the issue to Google Chrome, and although the description specifies Linux, WebRTC code is shared across platforms - defenders should verify whether other Chromium-based browsers inherit the same fix.

RemediationAI

Vendor-released patch: update Google Chrome on Linux to 148.0.7778.179 or later as published in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html; enterprise deployments should push the update via their managed browser policy or package manager and restart all Chrome processes to apply. Where immediate patching is not possible, disable WebRTC via enterprise policy (set WebRtcAllowLegacyTLSProtocols/WebRtcUdpPortRange restrictions or disable WebRTC entirely through the WebRtcLocalIpsAllowedUrls and related policies), with the side effect that Google Meet, video conferencing, and other real-time apps relying on PeerConnection will break. Browser-isolation or remote-browser-isolation gateways can also reduce exposure by ensuring crafted HTML is rendered off-endpoint, at the cost of latency and licensing. Cross-reference the upstream issue at https://issues.chromium.org/issues/504551032 to confirm fix inclusion in downstream Chromium-based browsers.