What is the CVSS score of CVE-2026-9896?

CVE-2026-9896 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9896?

Google Chrome's V8 JavaScript engine contains a high-severity remote code execution vulnerability (CVE-2026-9896, CVSS 8.8) that allows attackers to compromise systems by luring users to malicious…. A patch is available.

How to fix or mitigate CVE-2026-9896?

Within 24 hours: Issue security advisory to all users emphasizing not to ignore Chrome update prompts; verify current Chrome version distribution across endpoints. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all corporate devices through your patch management system (Group Policy, Intune, or equivalent); prioritize shared infrastructure and user-facing endpoints. Within 30 days: Verify 100% patch compliance across all Chrome installations through vulnerability scanning; ensure auto-update is enabled for future releases.

Google Chrome CVE-2026-9896

EUVD-2026-33191 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-r89w-9xc7-23rc

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:27 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 148.0.7778.216 allows remote attackers to execute arbitrary code inside the renderer sandbox by luring a user to a crafted HTML page. The flaw is a CWE-787 out-of-bounds write in V8 carrying a CVSS 8.8 (High) with Chromium severity rated High; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

V8 is Chrome's open-source JavaScript and WebAssembly engine that JIT-compiles untrusted script into native code; memory safety bugs in V8 are a recurring source of drive-by RCE because attacker-controlled JavaScript exercises the engine's optimizer and object model directly. CWE-787 (Out-of-bounds Write) in this context typically arises from incorrect bounds checks, type confusion downstream of optimizer assumptions, or miscalculated buffer sizes in TurboFan/Maglev/Sparkplug pipelines, letting crafted script corrupt adjacent heap metadata and pivot to arbitrary read/write primitives. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and the bug is confined to the V8 component running inside Chrome's renderer process, which is isolated by the Chromium sandbox - meaning exploitation here grants code execution inside that sandbox, not full host compromise on its own.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (Stable channel) - update immediately via Chrome's built-in updater or by redeploying the MSI/PKG/DEB from enterprise channels, per the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Downstream Chromium browsers should be upgraded once their vendors merge the V8 fix (track Edge, Brave, Opera, Vivaldi, and Electron security releases), and Android WebView and Chrome for Android should be updated through Play Store channels. If patching must be delayed, compensating controls include disabling the V8 JIT via the --js-flags=--jitless launch flag or enterprise policy (trade-off: significant JavaScript performance regression and breakage of WebAssembly-heavy sites), enabling Site Isolation and Strict Site Isolation if not already on (already default on desktop), and using network-level controls or browser extensions to block untrusted advertising, third-party scripts, and unknown domains to reduce the chance a user lands on a crafted page.