What is the CVSS score of CVE-2026-9118?

CVE-2026-9118 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9118?

Google Chrome on Windows contains a critical vulnerability enabling attackers to compromise employee devices by directing them to malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-9118?

Within 24 hours: Deploy Chrome 148.0.7778.179 or later to all Windows systems via managed deployment tools or forced updates. Within 7 days: Verify 100% patching compliance across the organization; audit endpoint logs for exploitation attempts. Within 30 days: Implement mandatory automatic browser updates and conduct phishing/social engineering awareness training emphasizing visiting untrusted sites.

Google Chrome CVE-2026-9118

EUVD-2026-31164 HIGH

Use After Free (CWE-416)

2026-05-20 Chrome

GHSA-m9c7-7f34-95c8

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:32 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to 148.0.7778.179 stems from a use-after-free flaw in the XR (WebXR) component, enabling a remote attacker to run arbitrary code in the renderer process by enticing a user to visit a crafted HTML page. Chromium rates the issue High severity and CVSS scores it 8.8; no public exploit identified at time of analysis and SSVC reports exploitation status as none. A vendor patch is available via the Stable Channel update referenced in the Chrome Releases advisory.

Technical ContextAI

The defect is classified as CWE-416 (Use After Free) in Chrome's XR subsystem, which implements the WebXR Device API enabling immersive VR/AR experiences in the browser. Use-after-free bugs occur when memory is freed but a dangling pointer is later dereferenced, allowing an attacker who can influence reallocation of that memory region to gain control over object dispatch - a classic primitive for renderer-process code execution in Chromium. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the Windows build prior to 148.0.7778.179 identified by the vendor, and the EUVD entry (EUVD-2026-31164) corroborates the fixed version boundary.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.179 for Windows - update via Chrome's built-in updater (chrome://settings/help) or push the Stable Channel build through enterprise management (Google Update / GPO / MDM) as described in the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Downstream Chromium browsers should be updated to a build that incorporates the Chromium fix referenced in https://issues.chromium.org/issues/498702233 once their vendors ship it. As a temporary compensating control before patching, disable WebXR by setting the chrome://flags/#webxr entry to Disabled or by using the WebXRRuntimeEnabled enterprise policy where supported - this removes the vulnerable XR code path from the attack surface at the cost of breaking VR/AR web experiences; additionally, restrict outbound web browsing to vetted sites or enforce Site Isolation and Safe Browsing Enhanced Protection to reduce drive-by exposure.