What is the CVSS score of CVE-2026-9897?

CVE-2026-9897 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9897?

Google Chrome versions prior to 148.0.7778.216 contain a high-severity remote code execution vulnerability that converts routine web browsing into a direct attack vector.. A patch is available.

How to fix or mitigate CVE-2026-9897?

Within 24 hours: Inventory all Chrome installations and assess current versions in use across the organization. Within 7 days: Deploy Chrome 148.0.7778.216 or later via your standard update mechanism, prioritizing systems with elevated access or sensitive data handling. Within 30 days: Verify complete deployment across all endpoints and disable older Chrome versions from execution.

Google Chrome CVE-2026-9897

EUVD-2026-33192 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-9vgv-pvr7-xg5g

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:27 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome prior to 148.0.7778.216 enables a remote attacker to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page that triggers a use-after-free in the DOM implementation. The flaw carries a CVSS 8.8 (High) rating reflecting network reach with required user interaction, and Google has rated the Chromium severity as High; no public exploit is identified at the time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Chromium's Document Object Model (DOM) subsystem, which manages the in-memory tree representing parsed HTML and exposes it to Blink's JavaScript engine. Use-after-free conditions occur when an object's backing memory is freed while a stale pointer remains reachable; subsequent access can be steered toward attacker-controlled memory, typically achieving type confusion or arbitrary read/write primitives leading to code execution within the renderer process. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the upstream Chrome product, and because Chromium is the foundation for Edge, Brave, Opera, Vivaldi, and Electron-based desktop applications, downstream consumers are likely to be affected pending their own respins.

RemediationAI

Apply the vendor-released patch by upgrading Google Chrome to 148.0.7778.216 or later on all desktop platforms; Chrome's auto-update mechanism will typically deliver this within 24-48 hours, but enterprise environments using managed update controls should explicitly force the relaunch, since the fix is only active after the browser process restarts. Administrators of Chromium-derived browsers should monitor the corresponding vendor channels (Edge Stable, Brave, Opera, Vivaldi) for respins that pull this fix, and Electron application maintainers should rebase to a patched Chromium build. If immediate patching is infeasible, compensating controls include enabling Site Isolation (already default), enforcing Enhanced Safe Browsing, and restricting browsing to allowlisted domains via enterprise policy (URLAllowlist/URLBlocklist) - these reduce exposure to crafted HTML pages but do not block trusted-site compromises or malvertising paths. Vendor advisory: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html.