What is the CVSS score of CVE-2026-9126?

CVE-2026-9126 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9126?

Google Chrome versions prior to 148.0.7778.179 contain a remote code execution vulnerability in the DOM implementation that executes arbitrary code within the browser when users visit a malicious…. A patch is available.

How to fix or mitigate CVE-2026-9126?

24 hours: Inventory all Chrome deployments across the organization and validate update infrastructure capability. 7 days: Deploy and test Chrome version 148.0.7778.179 or later in non-production environment and verify critical web application compatibility. 30 days: Complete mandatory rollout of patched Chrome to all endpoints via standard patch management process, with priority to systems handling sensitive data.

Google Chrome CVE-2026-9126

EUVD-2026-31168 HIGH

Use After Free (CWE-416)

2026-05-20 Chrome

GHSA-49pv-jm6v-mv97

Google RCE Denial Of Service Use After Free Memory Corruption Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:30 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.179 allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page that triggers a use-after-free in the DOM implementation. The flaw requires user interaction (visiting a malicious page) but no authentication, and while Chromium rates its security severity as Medium, the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chrome's DOM (Document Object Model) subsystem, which is implemented in Blink, Chromium's rendering engine. CWE-416 (Use After Free) occurs when memory is referenced after it has been freed, allowing an attacker to manipulate freed object slots - typically by triggering reallocation with attacker-controlled data - to corrupt object state, hijack vtable pointers, or otherwise gain code execution. DOM use-after-frees are a recurring class of bug in Blink because lifetime management across JavaScript callbacks, garbage-collected Oilpan objects, and raw C++ pointers is complex. CPE data confirms the affected product as cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all Chrome variants prior to the fixed build. Execution is confined to the renderer sandbox (Scope: Unchanged in CVSS), so additional sandbox-escape bugs would be needed for full host compromise.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.179 or later - upgrade Chrome Stable to this build or newer via the built-in updater (chrome://settings/help) or enterprise update channels such as Chrome Enterprise MSI/Google Update; see https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html and tracker https://issues.chromium.org/issues/496280532 for details. For downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) and Electron-based apps, install the corresponding patched version once each vendor ships it. If immediate patching is not possible, compensating controls include enforcing site isolation (already default in Chrome) and Strict Site Isolation policies via enterprise policy, restricting browsing of untrusted sites through web proxy/URL filtering or an isolated browser/RBI service, and disabling JavaScript on untrusted origins through enterprise policy (JavascriptAllowedForUrls/JavascriptBlockedForUrls) - note that broadly disabling JavaScript breaks most modern web applications and should be scoped narrowly. EDR with browser exploit detection can provide partial detection but is not a substitute for the upstream fix.