What is the CVSS score of CVE-2026-9894?

CVE-2026-9894 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9894?

Google Chrome versions prior to 148.0.7778.216 contain a critical sandbox escape vulnerability that allows attackers with a compromised renderer process to break isolation boundaries and gain…. A patch is available.

How to fix or mitigate CVE-2026-9894?

Within 24 hours: Audit Chrome versions across all managed endpoints to identify systems running versions prior to 148.0.7778.216. Within 7 days: Deploy Google Chrome 148.0.7778.216 or later organization-wide. Within 30 days: Verify 100% patching completion and confirm all Chrome instances meet minimum version 148.0.7778.216.

Google Chrome CVE-2026-9894

EUVD-2026-33189 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2rpm-hrh4-422j

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:34 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a use-after-free in the GPU process. Chrome rates the underlying memory corruption as High severity, and while no public exploit identified at time of analysis, the bug is part of a chained-exploit class historically weaponized against browsers. EPSS is very low (0.03%) reflecting the prerequisite of an already-compromised renderer rather than a direct one-shot RCE.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's GPU process, which handles graphics command buffers, WebGL/WebGPU, and compositing on behalf of renderer processes via Mojo IPC. The GPU process runs with broader OS privileges than the heavily sandboxed renderer, making it a long-standing target for sandbox-escape stage-twos. The affected component per the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome desktop builds; downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron apps) reuse the same GPU stack and are typically affected until they merge the upstream fix.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update via the Chrome Stable channel as described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and verify by navigating to chrome://settings/help to trigger the auto-updater and restart the browser. For Chromium-based browsers, apply the corresponding vendor build that incorporates the upstream fix (Edge, Brave, Opera, Vivaldi typically release within days). For Electron applications, upgrade to an Electron version built on Chromium 148.0.7778.216 or later. No targeted workaround is published for this specific issue; as a temporary compensating control, enterprises can enforce site isolation (already default), disable hardware acceleration via chrome://settings (reduces GPU-process attack surface at the cost of degraded rendering and battery life), or restrict browsing to vetted sites via policy until patching completes.