What is the CVSS score of CVE-2026-9887?

CVE-2026-9887 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9887?

Google Chrome versions prior to 148.0.7778.216 contain a use-after-free vulnerability enabling remote code execution when users encounter a malicious proxy configuration script.. A patch is available.

How to fix or mitigate CVE-2026-9887?

Within 24 hours: Determine Chrome deployment scope and confirm current versions in use; issue user guidance to avoid untrusted websites until patches are applied. Within 7 days: Deploy Chrome 148.0.7778.216 or later organization-wide using managed update channels (Windows Update, macOS Software Update, or mobile device management systems). Within 30 days: Audit patch compliance metrics and review endpoint logs for any suspicious PAC-related activity during the unpatched window.

Google Chrome CVE-2026-9887

EUVD-2026-33182 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-3pm9-x6w9-wfc3

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

9.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 20:30 vuln.today

CVSS changed

May 29, 2026 - 18:52 NVD

7.8 (HIGH) 8.8 (HIGH)

CVSS changed

May 29, 2026 - 18:22 NVD

7.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC script. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome prior to 148.0.7778.216 allows attackers to exploit a use-after-free condition in the Proxy component via a malicious PAC (Proxy Auto-Config) script delivered through a crafted web page. Chromium rates this as Critical severity, and while no public exploit identified at time of analysis, the EPSS score of 0.04% reflects low predicted exploitation activity despite the high CVSS 8.8 rating. Successful exploitation requires user interaction (UI:R) such as visiting an attacker-controlled page that triggers the vulnerable PAC processing path.

Technical ContextAI

The vulnerability resides in Chrome's Proxy subsystem, which evaluates PAC (Proxy Auto-Config) scripts - JavaScript-based files that browsers execute to determine which proxy server to use for a given URL. CWE-416 (Use-After-Free) indicates that the Proxy code retains and dereferences a pointer to heap memory after that memory has been freed, allowing an attacker who can influence allocation patterns to place attacker-controlled data into the reclaimed region and corrupt program state. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds, and the bug is reachable through the JavaScript-based PAC evaluation engine bundled in Chromium's network stack.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade to this Stable channel build or later immediately via Chrome's built-in updater or enterprise deployment tooling (advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Administrators managing Chromium-derivative browsers should wait for downstream advisories (Microsoft Edge, Brave, Opera) and apply those builds as released. If immediate patching is not possible, compensating controls include disabling automatic proxy configuration by setting the ProxySettings/ProxyMode enterprise policy to 'direct' or 'fixed_servers' to bypass PAC script evaluation entirely (side effect: breaks environments that rely on PAC/WPAD for proxy selection), and blocking outbound retrieval of untrusted PAC URLs via network egress filtering. Disabling JavaScript globally is technically a mitigation but is operationally infeasible for most users.