What is the CVSS score of CVE-2026-9877?

CVE-2026-9877 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9877?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability (CVSS 8.3) that could allow attackers to escalate from a compromised browser renderer process to full system…. A patch is available.

How to fix or mitigate CVE-2026-9877?

Within 24 hours: Identify all Chrome instances below version 148.0.7778.216 using endpoint discovery or MDM tools. Within 7 days: Deploy Chrome auto-update or push version 148.0.7778.216 or later through enterprise deployment mechanisms (Windows SCCM, Mac configuration management, or Chromebook policy). Within 30 days: Verify 100% of Chrome installations have been updated and confirm no instances remain below 148.0.7778.216 via endpoint telemetry or inventory audits.

Google Chrome CVE-2026-9877

EUVD-2026-33172 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-j7c2-phrm-27r8

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:30 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a use-after-free flaw in the ANGLE graphics translation layer. Exploitation requires user interaction with a crafted HTML page and is typically chained with a separate renderer-compromise bug. No public exploit identified at time of analysis, and EPSS is very low (0.03%), though Google rated the underlying issue Critical severity.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's abstraction library that translates WebGL and other OpenGL ES API calls into the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE code runs partly in the GPU process - which is more privileged than the renderer sandbox - memory safety bugs here are a classic pivot point for sandbox escapes. The root cause class, CWE-416 (Use After Free), occurs when an object is freed but a dangling pointer is later dereferenced, allowing an attacker who can groom the heap to redirect execution or corrupt adjacent state. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms shipping the Chromium ANGLE backend.

RemediationAI

Upgrade to the vendor-released patch: Google Chrome 148.0.7778.216 or later on Windows, macOS, and Linux via the Stable Channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and verify the fix by checking chrome://settings/help. Administrators of Chromium-derivative browsers and Electron apps should track upstream Chromium issue https://issues.chromium.org/issues/496445460 and roll the equivalent build once their vendor publishes it. Until patching is complete, compensating controls include disabling hardware acceleration in chrome://settings (removes the ANGLE attack surface at the cost of slower video, WebGL, and canvas rendering), blocking WebGL via enterprise policy (key=Disable3DAPIs, which breaks WebGL-based sites and games), and applying SiteIsolationOrigins/IsolateOrigins enterprise policy to limit blast radius if a renderer is compromised; none of these substitute for the upstream patch, which is the only complete fix.