What is the CVSS score of CVE-2026-9892?

CVE-2026-9892 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9892?

Google Chrome on Android versions before 148.0.7778.216 contain a vulnerability allowing attackers to bypass the browser's security sandbox-a critical safeguard designed to prevent malicious code…. A patch is available.

How to fix or mitigate CVE-2026-9892?

Within 24 hours: Identify which Android devices in your environment run Chrome and confirm your update deployment mechanism (MDM, carrier push, etc.); notify stakeholders of mandatory patching requirement. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all Android devices; configure automatic updates where possible. Within 30 days: Audit all Android devices to confirm 100% are running 148.0.7778.216 or later; document any exceptions and assess risk for non-compliant devices.

Google Chrome CVE-2026-9892

EUVD-2026-33187 HIGH

Improper Privilege Management (CWE-269)

2026-05-28 Chrome

GHSA-6xx9-x287-3539

Privilege Escalation Google Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:33 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting an inappropriate implementation in the Skia graphics library. Chromium rates the underlying issue as Critical severity, though no public exploit is identified at time of analysis and EPSS is very low at 0.03%. This is a chain-stage bug - exploitation requires a pre-existing renderer compromise, making it valuable as the second link in a full Android browser exploit chain rather than a standalone vector.

Technical ContextAI

Skia is the 2D graphics rendering library used by Chrome (and other Google products like Android and ChromeOS) for drawing text, geometries, and images; it runs partly in the sandboxed renderer and interacts with more privileged GPU and browser processes. The CWE-269 (Improper Privilege Management) classification, combined with the 'inappropriate implementation' phrasing and Scope:Changed CVSS metric, indicates that the flaw lets code already executing in the constrained renderer process cross a trust boundary by abusing Skia behavior to gain capabilities outside the renderer sandbox on Android. The affected CPE is cpe:2.3:a:google:chrome:*, with the EUVD listing pinning the fix at Chrome 148.0.7778.216 on the Android platform specifically.

RemediationAI

Vendor-released patch: Chrome for Android 148.0.7778.216 - update via Google Play to that version or later as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. There is no documented configuration workaround for this Skia behavior, so in environments where immediate update is not possible, compensating controls should focus on reducing the prerequisite renderer compromise: enforce Chrome auto-update through Android Enterprise / MDM policy, block known malicious domains at the network edge, and on managed Android fleets restrict browsing to vetted sites until devices report the patched version; users of downstream Chromium browsers (Edge, Brave, Samsung Internet) should update once each vendor ships a build that includes the Skia fix. Trade-offs: MDM-forced updates can interrupt user sessions, and URL allowlisting noticeably constrains usability, so these controls are best scoped to high-risk users until the patched build is fully deployed.