What is the CVSS score of CVE-2026-9879?

CVE-2026-9879 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9879?

Google Chrome versions prior to 148.0.7778.216 contain a critical remote code execution vulnerability (CVE-2026-9879) that allows unauthenticated attackers to execute arbitrary code when users visit…. A patch is available.

How to fix or mitigate CVE-2026-9879?

Within 24 hours: Inventory all Chrome deployments across endpoints and identify your organization's update mechanism (managed rollout, auto-update, or manual update). Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all affected systems via your standard patch management process, prioritizing critical and high-value systems first. Within 30 days: Verify patch compliance across all endpoints through vulnerability scanning or device inventory tools; document completion and establish a Chrome update policy requiring critical patches within 14 days of release.

Google Chrome CVE-2026-9879

EUVD-2026-33174 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-h292-v482-xhxh

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:26 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from an out-of-bounds write in the ANGLE graphics translation layer, allowing a remote attacker to execute arbitrary code in the browser's renderer context after a victim visits a crafted HTML page. Chromium rates this severity Critical and CVSS scores it 8.8, with vendor patches released via the Stable channel update; no public exploit identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's open-source graphics abstraction layer that translates WebGL and OpenGL ES API calls into native backend calls (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE parses and processes attacker-influenced graphics commands inside the renderer/GPU process, memory-safety defects in it are a well-known Chrome attack surface. The root cause class is CWE-787 (Out-of-bounds Write), in which the code writes data past the boundaries of an allocated buffer, typically leading to heap corruption that can be steered into arbitrary code execution. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering Chrome desktop builds before 148.0.7778.216.

RemediationAI

Vendor-released patch: Chrome Stable 148.0.7778.216 - upgrade immediately via the Stable channel update described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, then restart all browser instances to ensure the new binary is loaded (Chrome will not pick up the fix until relaunch). For enterprise fleets, push the update through Group Policy / MDM and verify chrome://version reports 148.0.7778.216 or later; downstream Chromium browsers should be updated as their vendors rebase. As a compensating control for hosts that cannot patch immediately, consider disabling WebGL via the WebGL.Disabled enterprise policy or chrome://flags to shrink the ANGLE attack surface (trade-off: breaks WebGL-dependent sites and apps), and restrict browsing to trusted sites via SafeSites / web filtering, since exploitation requires the user to load a crafted HTML page.