What is the CVSS score of CVE-2026-9876?

CVE-2026-9876 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9876?

Google Chrome for Android (prior to v148.0.7778.216) contains a critical sandbox escape vulnerability (CVE-2026-9876, CVSS 9.6) that could allow attackers to completely compromise employee Android…. A patch is available.

How to fix or mitigate CVE-2026-9876?

Within 24 hours: Inventory Chrome for Android deployments across all managed devices and communicate urgent update requirement to users. Within 7 days: Deploy Chrome for Android version 148.0.7778.216 or later through app distribution channels and mobile device management. Within 30 days: Verify 100% patch compliance through endpoint inventory controls and audit deployment.

Google Chrome CVE-2026-9876

EUVD-2026-33171 CRITICAL

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-79qp-xcjc-92vv

Google Use After Free Denial Of Service Memory Corruption Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:30 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android prior to 148.0.7778.216 allows a remote attacker who lures a user to a crafted HTML page to break out of the renderer sandbox by exploiting a use-after-free condition in the WebGL component. Chromium rates the issue Critical and CVSS scores it 9.6 due to the scope change from compromised renderer to host, though EPSS is only 0.03% (10th percentile) and no public exploit identified at time of analysis.

Technical ContextAI

The flaw lives in Chrome's WebGL implementation, the JavaScript-accessible binding that exposes OpenGL ES rendering primitives to web content through the GPU process. CWE-416 (Use After Free) means a graphics object is referenced after its backing memory has been released, allowing an attacker who controls subsequent allocations to redirect virtual dispatch or shape data into attacker-controlled memory. Because WebGL straddles the renderer/GPU process boundary on Android, a successful UAF here is particularly dangerous: the CVSS S:C (scope changed) flag and the description's explicit 'sandbox escape' language indicate the bug can be leveraged to execute code outside the normally-confined renderer, in a more privileged Chrome process on the device. The affected CPE is cpe:2.3:a:google:chrome:*, but the description narrows real-world impact to the Android build of Chrome.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.216 or later via Google Play; this is the vendor-released patch and is the only complete fix. For managed device fleets, push the update through MDM (Intune, Workspace ONE, Jamf, Android Enterprise managed Google Play) rather than relying on user-initiated updates, and verify rollout via Chrome's chrome://version page or remote attestation. As a temporary compensating control for devices that cannot update promptly, WebGL can be disabled by setting the DefaultWebGLPolicy / disabling chrome://flags/#disable-webgl through Chrome enterprise policy, which neutralizes the affected attack surface at the cost of breaking legitimate WebGL-dependent web apps (Google Maps 3D, in-browser CAD tools, WebGL games). Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for the official release notes.