What is the CVSS score of CVE-2026-9878?

CVE-2026-9878 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9878?

Google Chrome versions prior to 148.0.7778.216 contain a critical remote code execution vulnerability in the graphics rendering engine (ANGLE) that allows attackers to execute arbitrary code through…. A patch is available.

How to fix or mitigate CVE-2026-9878?

Within 24 hours: Assess Chrome deployment count and versions across endpoints. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all systems. Within 30 days: Validate patch deployment coverage and monitor endpoint logs and security telemetry for exploitation indicators.

Google Chrome CVE-2026-9878

EUVD-2026-33173 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-54q4-ch9p-5885

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:25 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free flaw in ANGLE, the graphics abstraction layer that translates OpenGL ES calls to native GPU APIs. A remote attacker who lures a user into visiting a crafted HTML page can execute arbitrary code within the renderer sandbox, with Chromium rating the severity as Critical. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chrome uses to translate WebGL and other OpenGL ES API calls into the underlying graphics backend (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). The CWE-416 use-after-free root cause indicates that ANGLE retains and dereferences a pointer to a graphics resource (such as a texture, buffer, or context object) after its memory has been freed, allowing an attacker who controls the heap layout via crafted WebGL shaders or draw calls to substitute attacker-controlled data at that location. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome variants are in scope where ANGLE/WebGL is enabled, which is the default across desktop platforms.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html; the Chromium issue tracker entry is at https://issues.chromium.org/issues/499054245. Enterprise administrators should push the update through Chrome Browser Cloud Management or Group Policy and verify via chrome://settings/help. If immediate patching is not feasible, disabling hardware acceleration (chrome://settings/system → Use graphics acceleration when available) reduces ANGLE attack surface for WebGL workloads at the cost of slower video/graphics performance and broken WebGL apps; alternatively, enforce strict site isolation and block WebGL via the URLBlocklist or HardwareAccelerationModeEnabled enterprise policy, which will break legitimate 3D web content. Downstream Chromium browsers (Edge, Brave, Opera) should be updated as their vendors ship the merged fix.