What is the CVSS score of CVE-2026-9881?

CVE-2026-9881 has a contested CVSS base score of 9.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-9881?

Google Chrome on macOS has a critical sandbox escape vulnerability (CVE-2026-9881) that could allow attackers to install malware and steal data if users install a malicious extension.. A patch is available.

How to fix or mitigate CVE-2026-9881?

Within 24 hours: Issue organization-wide security alert to macOS Chrome users advising against installation of untrusted extensions and communicating vulnerability details. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all macOS endpoints via mobile device management or endpoint configuration automation. Within 30 days: Audit installed extensions across the organization, remove non-business-critical extensions, and verify 100% patch compliance via automated inventory reporting.

Google Chrome CVE-2026-9881

EUVD-2026-33176 CRITICAL

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-5fc2-9c9r-4rvq

Google Use After Free Denial Of Service Memory Corruption Chrome

Critical

Disputed · 9.0 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

8.2 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:31 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.0 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.0

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on macOS versions prior to 148.0.7778.216 allows attackers to break out of the browser's renderer sandbox via a use-after-free flaw in the Bluetooth component. Exploitation requires convincing a user to install a malicious Chrome Extension, which then triggers the bug through crafted extension interactions. Chromium rates this Critical severity; no public exploit identified at time of analysis and EPSS remains low (0.01%) despite the high CVSS of 9.0.

Technical ContextAI

The flaw resides in Chrome's Bluetooth subsystem, which provides Web Bluetooth and extension-facing APIs allowing pages and extensions to discover and communicate with nearby Bluetooth Low Energy devices. CWE-416 (Use After Free) indicates that the Bluetooth code path retains and dereferences a pointer to a heap object after that object has been freed, typically due to mismatched object lifetimes between asynchronous Bluetooth events and JavaScript-driven extension callbacks. Because the bug enables a sandbox escape, the freed object is reachable from the broker/utility process that handles Bluetooth on macOS, allowing a compromised renderer or extension process to gain code execution outside the renderer sandbox. The single affected CPE (cpe:2.3:a:google:chrome) is constrained by the description to macOS builds prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for macOS - upgrade the stable channel immediately by allowing Chrome's auto-update to complete or deploying the build via MDM, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As a compensating control until patching completes, restrict extension installation to an enterprise allowlist using the ExtensionInstallAllowlist / ExtensionInstallBlocklist policies (side effect: blocks legitimate user-installed extensions and increases helpdesk load), and consider setting ExtensionInstallForcelist to pin only vetted extensions. Disabling Web Bluetooth and the experimental Web Bluetooth API via the DefaultWebBluetoothGuardSetting policy reduces the available attack surface for the Bluetooth subsystem, with the trade-off that any internal tooling relying on Web Bluetooth will break. Hunt for recently installed unknown extensions across the macOS fleet as a detection measure.