What is the CVSS score of CVE-2026-9875?

CVE-2026-9875 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9875?

A critical sandbox escape vulnerability in Google Chrome for Android (CVE-2026-9875, CVSS 9.6) enables remote attackers to break out of the renderer process and potentially access sensitive corporate…. A patch is available.

How to fix or mitigate CVE-2026-9875?

Within 24 hours: Inventory Android devices running Chrome through MDM consoles and confirm current versions. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all Android devices using Google Play managed deployment or MDM policies; enforce automatic updates. Within 30 days: Verify 100% patch coverage, audit device logs for exploitation indicators, and document remediation completion.

Google Chrome CVE-2026-9875

EUVD-2026-33170 CRITICAL

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-8p9p-rrq9-qjgw

Google Information Disclosure Buffer Overflow Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:29 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows remote attackers to potentially break out of the renderer sandbox via an out-of-bounds read in the WebGL component when a victim visits a crafted HTML page. Chromium rates the underlying issue as Critical severity, and while no public exploit is identified at time of analysis (EPSS 0.03%), the combination of scope-change (S:C) and full CIA impact makes this a high-priority browser patch for Android fleets.

Technical ContextAI

The flaw resides in WebGL, the JavaScript API that Chrome exposes to web content for hardware-accelerated 3D graphics via the GPU process. CWE-125 (Out-of-bounds Read) here means specially-crafted WebGL state or buffers cause the renderer to read memory outside an allocated buffer; in the context of Chrome's multi-process model, an OOB read in WebGL can leak addresses or pointers needed to chain into a sandbox escape from the GPU/renderer process. Affected CPE is cpe:2.3:a:google:chrome on the Android platform, where the GPU sandbox boundary historically differs from desktop and has been a recurring target for chain exploits.

RemediationAI

Vendor-released patch: Chrome for Android 148.0.7778.216 - update via Google Play Store or managed enterprise deployment per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Where immediate patching is not feasible, a workable compensating control is to disable WebGL on Android Chrome through enterprise policy (HardwareAccelerationModeEnabled / chrome://flags WebGL toggles) or by routing browsing through a policy that blocks untrusted sites; the trade-off is broken rendering on legitimate 3D/canvas-heavy sites and degraded performance. Network-layer mitigations (web filtering / browser isolation for high-risk users) reduce exposure but do not address the root cause and add latency and cost.