What is the CVSS score of CVE-2026-9120?

CVE-2026-9120 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9120?

A high-severity remote code execution vulnerability in Google Chrome versions prior to 148.0.7778.179 exposes all Chrome users to arbitrary code execution when visiting crafted webpages.. A patch is available.

How to fix or mitigate CVE-2026-9120?

Within 24 hours: Notify all users of the Chrome update requirement and begin deployment preparation. Within 7 days: Deploy Chrome version 148.0.7778.179 or later across all organizational systems through standard update mechanisms. Within 30 days: Verify patch compliance and document remediation of any systems not yet updated.

Google Chrome CVE-2026-9120

EUVD-2026-31169 HIGH

Use After Free (CWE-416)

2026-05-20 Chrome

GHSA-p85v-6f3q-83wg

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:33 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.179 stems from a use-after-free flaw in the WebRTC component, enabling a remote attacker to run arbitrary code when a victim visits a crafted HTML page. Chromium rates the severity as High and the CVSS 3.1 score is 8.8, but exploitation requires user interaction (UI:R); no public exploit identified at time of analysis.

Technical ContextAI

WebRTC (Web Real-Time Communication) is the browser subsystem that powers peer-to-peer audio, video, and data-channel communication and is implemented in C++ within the Chromium codebase. The root cause is CWE-416 (Use After Free), a memory-safety class of bug in which the program continues to dereference a pointer to memory that has already been released - allowing an attacker who can influence allocator state to place controlled data into the freed region and corrupt program control flow. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds before the 148.0.7778.179 stable channel release.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.179 - update all desktop installations to this stable channel build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html, ideally by enforcing automatic updates through enterprise policy and verifying via chrome://settings/help. For Chromium-derivative browsers, install the corresponding rebased build once published by each vendor. Until patching is complete, a viable compensating control is to disable or restrict WebRTC at the enterprise policy level (for example by setting WebRtcIPHandling to disable_non_proxied_udp or applying URLBlocklist entries that block WebRTC-enabling sites), accepting the side effect that this will break video conferencing, voice calls, and other real-time-communication web apps; combine with strict URL allowlisting and end-user warnings against opening untrusted links.