What is the CVSS score of CVE-2026-9873?

CVE-2026-9873 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9873?

Google Chrome desktop versions prior to 148.0.7778.216 contain a critical remote code execution vulnerability that activates when users visit a crafted webpage, enabling attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-9873?

Within 24 hours: Initiate forced deployment of Chrome version 148.0.7778.216 or later to all managed endpoints; verify auto-update settings are enabled organization-wide. Within 7 days: Confirm patch deployment across 100% of Chrome installations via endpoint telemetry; prioritize unmanaged devices by disabling legacy Chrome versions on network access controls. Within 30 days: Generate patch compliance report, establish monitoring for exploitation indicators, and review browser access controls to restrict high-risk domains.

Google Chrome CVE-2026-9873

EUVD-2026-33168 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-jmg2-vqr6-g8h5

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:25 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code within the renderer sandbox by serving a crafted HTML page that triggers a use-after-free condition in the Network component. Google rates the underlying Chromium issue as Critical severity, and no public exploit identified at time of analysis, though the bug class and reachable attack surface make it a high-priority browser patch.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's Network component, the subsystem responsible for fetching, parsing, and dispatching network resources (HTTP responses, fetch/XHR pipelines, prefetch and preload handlers). Use-after-free bugs occur when an object is freed while a dangling pointer to it is still reachable; an attacker who can influence allocation/free timing from web content can groom the heap, reclaim the freed slot with attacker-controlled data, and pivot the dangling pointer into a type confusion or controlled write primitive. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds up to the fixed release 148.0.7778.216, and Chromium-derived browsers (Edge, Brave, Opera, Vivaldi, Electron apps) typically inherit the same defect until they pull the upstream fix.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update via the Stable channel using Chrome's built-in updater or by relaunching the browser, and verify the version under chrome://settings/help; enterprise fleets should push the update via Google Update for Business, Intune, Jamf, or equivalent MDM and confirm rollout per the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For Chromium derivatives, install the corresponding vendor release that pulls the upstream fix (Edge, Brave, Opera, Vivaldi advisories typically follow within days), and update any bundled Electron/CEF applications. If patching must be delayed, compensating controls include enforcing Site Isolation (already default but verify chrome://flags/#enable-site-per-process is enabled), enabling Enhanced Safe Browsing to block known malicious pages, restricting browsing via a web proxy/URL filter to reduce exposure to untrusted HTML, and disabling JavaScript or using a strict allowlist for high-risk users - at the cost of breaking most modern web applications.