What is the CVSS score of CVE-2026-9893?

CVE-2026-9893 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9893?

Google Chrome (versions before 148.0.7778.216) is vulnerable to a privilege escalation attack that could allow threat actors to compromise employee devices after initial browser compromise.. A patch is available.

How to fix or mitigate CVE-2026-9893?

Within 24 hours: Audit all Chrome deployments to identify affected versions (any version prior to 148.0.7778.216). Within 7 days: Deploy Chrome 148.0.7778.216 or later via your enterprise browser deployment system and verify completion rates above 90%. Within 30 days: Confirm patch deployment to 100% of endpoints and close any gaps in Chrome fleet management.

Google Chrome CVE-2026-9893

EUVD-2026-33188 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2pm8-794w-p8m4

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:34 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a crafted HTML page that triggers a use-after-free in the Skia graphics library. Google rated this Critical internally, though no public exploit identified at time of analysis and EPSS scores exploitation probability at just 0.03% (11th percentile). The flaw requires chaining with a separate renderer compromise, so it is a second-stage primitive rather than a single-shot RCE.

Technical ContextAI

Skia is the open-source 2D graphics library that Chromium uses for rasterizing web content, including paths, text, images, and effects exposed through Canvas, WebGL, and CSS rendering. The CWE-416 use-after-free class occurs when a pointer to a freed object continues to be dereferenced, allowing an attacker who can control heap layout (already trivial from a compromised renderer) to coerce the freed slot into holding attacker-controlled data and pivot execution. Because Skia runs partly in privileged GPU/browser process contexts that the renderer can reach through Mojo IPC, a UAF here can be steered into a sandbox escape rather than a renderer-only crash. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms prior to the fixed Stable Channel build.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update Chrome to this version or later via the built-in updater (chrome://settings/help) or by redeploying the MSI/PKG/DEB through your management tooling, then force a browser restart to load the patched binaries (in-memory exploit windows persist until restart). For Chromium-derived browsers, monitor their respective vendor advisories and apply the corresponding update once they pick up the Skia fix; refer to https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for vendor confirmation. No standalone workaround is practical because Skia is core to web content rendering and cannot be disabled, but compensating controls during rollout include enforcing Site Isolation (already default), enabling the Chrome 'Enhanced' Safe Browsing mode to reduce exposure to malicious pages, restricting browsing on high-value endpoints to allowlisted sites via enterprise policy (trade-off: breaks general browsing), and disabling hardware-accelerated GPU rasterization via the --disable-gpu-rasterization flag (trade-off: noticeable rendering performance regression, and this only reduces - does not eliminate - Skia attack surface).