What is the CVSS score of CVE-2026-9895?

CVE-2026-9895 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9895?

Google Chrome versions before 148.0.7778.216 contain a sandbox escape vulnerability that allows an attacker with prior renderer process compromise to achieve full system-level access, bypassing…. A patch is available.

How to fix or mitigate CVE-2026-9895?

Within 24 hours: Verify automatic Chrome updates are enabled and communicate patch deadline (Chrome 148.0.7778.216 or later) to users and IT teams. Within 7 days: Deploy patch across 95% of Chrome instances via endpoint management tools and confirm version compliance. Within 30 days: Audit deployment metrics and document patching timeline in security compliance records.

Google Chrome CVE-2026-9895

EUVD-2026-33190 HIGH

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-6347-r2hx-j4hv

Google Information Disclosure Buffer Overflow Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:35 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via an out-of-bounds read in the GPU process triggered by a crafted HTML page. Google rates the underlying issue as High severity, and while a vendor patch is shipped, EPSS shows only 0.03% (11th percentile) exploitation probability and no public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The flaw is a CWE-125 out-of-bounds read inside Chrome's GPU process, which handles accelerated graphics, WebGL, and compositing on behalf of renderer processes. Chrome's multi-process security model isolates untrusted web content inside sandboxed renderers, and the GPU process is one of the privileged IPC endpoints renderers can talk to; an OOB read here can leak memory contents (pointers, ASLR offsets, sandbox tokens) that an attacker uses to defeat sandbox containment. Per the CPE cpe:2.3:a:google:chrome:*, all Chrome builds before the fixed Stable channel release are affected across desktop platforms.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 - update Chrome to 148.0.7778.216 or later via the Stable channel and restart the browser to apply the GPU process fix, per the Chrome Releases advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium issue tracker at issues.chromium.org/issues/491685406. Enterprises should push the update via Chrome Browser Cloud Management, Group Policy, or their MDM and verify with chrome://settings/help. As a temporary compensating control prior to patching, administrators can disable hardware acceleration (chrome://settings/system → 'Use hardware acceleration when available' off, or the HardwareAccelerationModeEnabled policy) to reduce reliance on the vulnerable GPU code paths, accepting the trade-off of degraded video, WebGL, and canvas performance; this does not eliminate all GPU process code paths and should not substitute for patching.