What is the CVSS score of CVE-2026-9874?

CVE-2026-9874 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9874?

Google Chrome versions prior to 148.0.7778.216 contain a critical sandbox escape vulnerability (CVE-2026-9874, CVSS 9.6) that allows remote attackers to compromise endpoints through crafted webpages.. A patch is available.

How to fix or mitigate CVE-2026-9874?

24 hours: Inventory Chrome deployments across all endpoints and prepare patch distribution; notify users to exercise caution with untrusted websites during transition. 7 days: Deploy Chrome 148.0.7778.216 or later to all organizational endpoints and confirm installation on 95%+ of devices. 30 days: Achieve 100% patch deployment; conduct security audit for exploitation attempts.

Google Chrome CVE-2026-9874

EUVD-2026-33169 CRITICAL

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-wv87-9xgv-7mrw

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:29 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker to exploit a use-after-free condition in the Dawn WebGPU implementation through a crafted HTML page, leading to potential escape from the browser's renderer sandbox. The flaw carries a CVSS 9.6 with scope change reflecting cross-boundary impact, and while no public exploit identified at time of analysis, Google's own classification of the underlying Chromium severity as Critical signals significant risk to end users. EPSS is currently low (0.03%, 11th percentile), suggesting no widespread exploitation has been observed yet despite the severity.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing a cross-platform abstraction layer over native graphics APIs (Vulkan, Metal, D3D12). It runs partly in the GPU process, which sits outside the renderer sandbox boundary, making memory corruption bugs in this component particularly dangerous for sandbox escape scenarios. CWE-416 (Use After Free) occurs when memory is referenced after it has been freed, allowing an attacker to manipulate the freed allocation - often by controlling reallocation contents - to hijack control flow, leak data, or corrupt adjacent state. In the context of Dawn, malicious WebGPU shader or command sequences from a crafted HTML page can trigger object lifetime mismanagement to break out of normal renderer isolation. The affected CPE is cpe:2.3:a:google:chrome (all versions prior to the fix).

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Stable channel desktop installations to this version or later via Chrome's auto-update mechanism, verified at chrome://settings/help, and restart the browser to load the fix; the official advisory is at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise administrators should validate their managed update channel and force-deploy via group policy where auto-update is disabled, and downstream Chromium-based browser users (Edge, Brave, Opera, Electron apps) should track their respective vendors' rebase advisories. As a temporary compensating control before patching, WebGPU can be disabled via the chrome://flags/#enable-unsafe-webgpu setting (set to Disabled) or by enterprise policy, which removes the attack surface in Dawn at the cost of breaking sites that depend on WebGPU-accelerated graphics or compute; alternatively, browsing untrusted sites only in a hardened/isolated environment until patching completes reduces exposure.