What is the CVSS score of CVE-2026-9886?

CVE-2026-9886 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9886?

A critical sandbox escape in Google Chrome on macOS (CVE-2026-9886, CVSS 9.6) enables remote attackers to achieve system-level code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-9886?

24 hours: Issue security alert to all macOS users; prepare deployment package for Chrome 148.0.7778.216 or later. 7 days: Complete patch deployment to all macOS Chrome installations and verify version compliance across inventory. 30 days: Audit macOS system and browser logs from the vulnerability disclosure period to identify any exploitation attempts.

Google Chrome CVE-2026-9886

EUVD-2026-33181 CRITICAL

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-rmrv-48gv-336h

Google Use After Free Denial Of Service Memory Corruption Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.3 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:32 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 148.0.7778.216 allows a remote attacker to break out of the renderer sandbox by enticing a user to visit a crafted HTML page that triggers a use-after-free in the Base component. Chromium rates the severity Critical and CVSS scores it 9.6, though no public exploit is identified at time of analysis and EPSS exploitation probability is currently very low (0.03%).

Technical ContextAI

The flaw lives in Chromium's 'Base' subsystem - the foundational C++ utility library (//base) used across the browser, including by the renderer process on macOS. The root cause class is CWE-416 (Use-After-Free): a heap object is referenced after it has been freed, allowing an attacker who controls heap layout to coerce the freed slot into containing attacker-influenced data, leading to memory corruption and control-flow hijack. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* combined with the description scopes the issue to the macOS Chrome build; the CVSS scope-change flag (S:C) reflects that the bug crosses Chrome's sandbox boundary, meaning successful exploitation moves the attacker out of the constrained renderer process and into a higher-privileged context.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for macOS - upgrade immediately via the Stable channel by relaunching Chrome or pushing the update through your endpoint management tooling, per https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, verify Chrome's auto-update policy is not disabled and that the macOS Keystone updater is reachable. Until users have restarted into the fixed build, compensating controls include enforcing Site Isolation (already default), restricting browsing on macOS endpoints to trusted sites via proxy or DNS filtering, and steering high-risk users to a temporarily different browser; note these reduce but do not eliminate exposure because any visited page can deliver the exploit, and that aggressive URL filtering can break legitimate workflows.