What is the CVSS score of CVE-2026-9872?

CVE-2026-9872 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9872?

Google Chrome for Android versions prior to 148.0.7778.216 contain a critical vulnerability allowing remote code execution when users visit a crafted webpage, completely bypassing Chrome's browser…. A patch is available.

How to fix or mitigate CVE-2026-9872?

Within 24 hours: Alert device administrators and end users that Chrome updates are mandatory security patches, not optional. Within 7 days: Deploy Google Chrome version 148.0.7778.216 or later to all Android devices via MDM or app store management; confirm deployment completion via inventory system. Within 30 days: Audit all Android devices to verify Chrome is at 148.0.7778.216 or later; retire or isolate any devices where enforcement failed.

Google Chrome CVE-2026-9872

EUVD-2026-33167 CRITICAL

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-m7rr-c95c-r68r

Buffer Overflow Google Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:29 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows remote attackers to corrupt GPU process memory via a crafted HTML page, breaking out of the renderer sandbox boundary. Chromium rates this Critical severity with a CVSS of 9.6 due to scope change, though EPSS remains low at 0.03% and no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in Chrome's GPU process, which handles hardware-accelerated rendering, WebGL, and compositing on behalf of sandboxed renderer processes. CWE-787 (Out-of-bounds Write) indicates memory corruption where the GPU component writes data past the bounds of an allocated buffer, typically due to insufficient length validation when parsing attacker-controlled graphics commands or shader inputs. Because the GPU process runs with higher privileges than the renderer sandbox in Chromium's multi-process architecture, corrupting its memory provides a path to escape the renderer's restrictive sandbox. The CPE cpe:2.3:a:google:chrome covers Chrome browser builds, with the Android platform specifically called out in the description.

RemediationAI

Vendor-released patch: Chrome for Android 148.0.7778.216 or later - update via Google Play Store or push the update through enterprise mobility management (Android Enterprise, Intune, Workspace ONE). In environments where immediate update is not feasible, compensating controls include restricting Chrome on Android to trusted-only browsing through a managed configuration, disabling hardware acceleration via the chrome://flags 'Override software rendering list' / GPU compositing flags (trade-off: significant performance and battery degradation on graphics-heavy sites and breakage of WebGL/WebGPU content), or routing traffic through a web filtering proxy that blocks known malicious domains. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium bug tracker at https://issues.chromium.org/issues/505077859 for fix details.