What is the CVSS score of CVE-2026-9891?

CVE-2026-9891 has a contested CVSS base score of 9.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-9891?

Google Chrome versions prior to 148.0.7778.216 contain a critical sandbox escape vulnerability that allows attackers who have already compromised the browser's renderer process to achieve full…. A patch is available.

How to fix or mitigate CVE-2026-9891?

Within 24 hours: Deploy notification requiring Chrome update to 148.0.7778.216 or later; audit enterprise Chrome deployments for patch applicability. Within 7 days: Verify patch deployment across user endpoints; enable automatic Chrome updates organization-wide if not currently configured. Within 30 days: Confirm patch compliance rates; review security logs for renderer process anomalies or suspected compromise attempts; document remediation completion.

Google Chrome CVE-2026-9891

EUVD-2026-33186 CRITICAL

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-j27f-xg68-8fvv

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.0 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

9.0 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:33 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.0 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.0

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome before 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted Chrome Extension exploiting a use-after-free in the Extensions component. Chromium rates the underlying flaw as Critical severity, though no public exploit has been identified at time of analysis and EPSS exploitation probability sits at 0.03% (11th percentile).

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in Chrome's Extensions subsystem, which manages the lifecycle of extension objects within the browser process. Use-after-free bugs occur when memory is referenced after it has been deallocated, allowing an attacker to control the contents at that address and hijack object dispatch (e.g., vtable pointers) to achieve arbitrary code execution. Because the Extensions code runs in the privileged browser process rather than the sandboxed renderer, exploiting this flaw lets attacker-controlled code cross the renderer/browser trust boundary - the canonical mechanism for a Chromium sandbox escape. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome desktop builds prior to the fixed version are in scope.

RemediationAI

Vendor-released patch: update Google Chrome to version 148.0.7778.216 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html; restart the browser after install to apply the fix. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should install the corresponding vendor update that incorporates this Chromium milestone. As compensating controls until patching completes, restrict installation of untrusted extensions via enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) since exploitation is delivered through a crafted extension - note this breaks legitimate user-installed extensions; additionally, enforce Site Isolation (enabled by default) to limit renderer-process compromise opportunities and reduce the value of the sandbox-escape primitive.