What is the CVSS score of CVE-2026-9883?

CVE-2026-9883 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9883?

Google Chrome prior to version 148.0.7778.216 contains a critical use-after-free vulnerability enabling remote code execution when users visit malicious websites, creating risk of device compromise…. A patch is available.

How to fix or mitigate CVE-2026-9883?

Within 24 hours: Inventory current Chrome versions deployed and validate patch 148.0.7778.216 compatibility in staging environment. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all managed Chrome instances via standard patch management; verify auto-update is enabled for unmanaged deployments. Within 30 days: Audit deployment completion to 100% patch coverage, review security event logs for exploitation activity during the interim window, and update browser configuration standards to require minimum version 148.0.7778.216.

Google Chrome CVE-2026-9883

EUVD-2026-33178 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-gm6j-c6r6-723x

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:26 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code via a crafted HTML page exploiting a use-after-free flaw in the Base component. Chromium classifies the severity as Critical, and Google has shipped a stable channel update; no public exploit has been identified at time of analysis. Exploitation requires user interaction (visiting a malicious page), which is the typical drive-by browser attack model.

Technical ContextAI

The vulnerability is a CWE-416 (Use After Free) defect in Chrome's 'Base' component, which provides foundational primitives (memory management, threading, containers) reused throughout the Chromium codebase. Use-after-free conditions arise when freed heap memory is referenced again, allowing an attacker who controls heap layout via a crafted HTML/JavaScript page to coerce the renderer or related process into operating on attacker-influenced data, typically yielding control of a function pointer or vtable and subsequent code execution. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, fixed in the 148.0.7778.216 stable channel build.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 on the stable channel - update immediately via Chrome's built-in updater or by forcing a restart, and enterprise administrators should push the corresponding MSI/policy update so endpoints relaunch the browser to apply the fix (Chrome will not finish updating until a restart). The advisory is published at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and tracker details at https://issues.chromium.org/issues/506477192. For Chromium-based browsers, await and apply the corresponding vendor releases (Edge, Brave, Opera, Vivaldi) that rebase onto the patched Chromium. As a compensating control until patching completes, restrict browsing to trusted sites via enterprise URL allowlisting and enable Site Isolation and the Chrome sandbox (both default-on) - note that allowlisting breaks normal web access and is only viable for kiosk or high-sensitivity workstations; disabling JavaScript globally would mitigate heap-grooming but breaks most modern sites and is generally impractical.