What is the CVSS score of CVE-2026-9112?

CVE-2026-9112 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9112?

Google Chrome on Windows versions prior to 148.0.7778.179 contains a remote code execution vulnerability affecting all enterprise users.. A patch is available.

How to fix or mitigate CVE-2026-9112?

Within 24 hours: Identify all Windows systems with Google Chrome, assess patch testing requirements, and begin communication to users about upcoming updates. Within 7 days: Deploy Chrome version 148.0.7778.179 across all Windows endpoints using automatic updates or centralized deployment mechanisms. Within 30 days: Verify patch compliance through vulnerability scanning, audit deployment logs, and monitor for any exploitation attempts.

Google Chrome CVE-2026-9112

EUVD-2026-31158 HIGH

Use After Free (CWE-416)

2026-05-20 Chrome

GHSA-j2gw-w7xw-rj29

Microsoft Google RCE Denial Of Service Use After Free Memory Corruption Suse Red Hat Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:30 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to version 148.0.7778.179 stems from a use-after-free condition in the GPU component, enabling a remote attacker to run arbitrary code within the renderer sandbox after the victim loads a crafted HTML page. Google has rated the issue High severity and shipped a fix; no public exploit identified at time of analysis and SSVC indicates exploitation status 'none' despite total technical impact.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's GPU process, which handles hardware-accelerated rendering, WebGL, WebGPU, and compositing operations. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the EUVD record narrowing impact to Chrome builds below 148.0.7778.179 on Windows. Use-after-free bugs in the GPU process arise when an object is freed but a dangling pointer is later dereferenced, allowing an attacker who controls the freed memory's contents to hijack control flow; in Chrome's multi-process model the GPU process is privileged relative to the renderer but still confined by the OS sandbox, which is why the advisory explicitly notes code execution 'inside a sandbox.'

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.179 or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Most installations will receive the update automatically on next restart, but managed Windows fleets should accelerate the rollout through enterprise update channels or Group Policy and verify chrome://version reports the patched build. Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) inherit GPU-process code and should be updated once their respective vendors ship a corresponding release. As a temporary compensating control until patching completes, administrators can launch Chrome with --disable-gpu to disable GPU acceleration, which removes the vulnerable code path at the cost of degraded video playback, WebGL, and rendering performance; blocking high-risk browsing categories at the proxy layer also reduces the chance users encounter a crafted HTML page.