What is the CVSS score of CVE-2026-9114?

CVE-2026-9114 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9114?

Google Chrome versions prior to 148.0.7778.179 contain a remote code execution vulnerability in the QUIC networking stack that executes arbitrary code when users visit malicious websites or receive…. A patch is available.

How to fix or mitigate CVE-2026-9114?

Within 24 hours: Publish and begin force-deployment of Chrome 148.0.7778.179 or later through your endpoint management system (MDM, Group Policy, or equivalent) with automatic restart enabled. Within 7 days: Verify deployment compliance to at least 95% of Chrome-using endpoints via inventory scanning and block non-compliant systems from sensitive applications if feasible. Within 30 days: Audit enterprise Chrome policies to confirm automatic updates are enforced, review security logs for exploitation attempts, and conduct user training on recognizing malicious websites.

Google Chrome CVE-2026-9114

EUVD-2026-31162 HIGH

Use After Free (CWE-416)

2026-05-20 Chrome

GHSA-prq9-v8fh-p62p

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:31 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.179 stems from a use-after-free condition in the QUIC networking stack, allowing remote attackers to execute arbitrary code within the browser sandbox via malicious network traffic. Exploitation requires user interaction (visiting a malicious site or processing attacker-controlled QUIC traffic), and no public exploit has been identified at time of analysis. Chromium rates this as High severity, and a vendor patch is available.

Technical ContextAI

The vulnerability resides in Chrome's implementation of QUIC, the UDP-based transport protocol underlying HTTP/3 that handles connection establishment, stream multiplexing, and congestion control entirely in user space. CWE-416 (Use After Free) indicates that memory referenced by a pointer is freed but the pointer continues to be accessed, leading to undefined behavior that attackers can shape into arbitrary read/write primitives and ultimately code execution. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the issue spans Chrome desktop builds, and because QUIC connections are negotiated during normal web browsing, the attack surface is exposed any time the browser communicates with an attacker-controlled or attacker-influenced QUIC endpoint.

RemediationAI

Vendor-released patch: 148.0.7778.179 - upgrade Chrome to 148.0.7778.179 or later via the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html, which can be triggered by restarting the browser once the auto-updater has retrieved the build. For fleet-managed environments, push the update via Chrome Browser Cloud Management, group policy, or your endpoint management platform and verify the version on endpoints. As a temporary compensating control before patch deployment, administrators can disable QUIC by setting the QuicAllowed enterprise policy to false or launching with --disable-quic, which forces fallback to TCP-based HTTP/1.1 or HTTP/2 at the cost of slower connection setup and degraded performance on sites that rely on HTTP/3; this should be reverted once the patch is in place. Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be checked against their vendors' advisories since they typically ship a follow-on fix within days.