What is the CVSS score of CVE-2026-9898?

CVE-2026-9898 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9898?

Google Chrome on Android prior to version 148.0.7778.216 is vulnerable to a sandbox escape (CVSS 8.3) that could allow attackers with prior access to Chrome to take control of the device.. A patch is available.

How to fix or mitigate CVE-2026-9898?

Within 24 hours: Inventory Chrome on Android installations across managed devices and prepare user communications. Within 7 days: Distribute Chrome version 148.0.7778.216 or later through mobile device management (MDM) for managed devices; notify users to update personal devices. Within 30 days: Verify 90% or greater adoption of patched Chrome versions and document remediation completion.

Google Chrome CVE-2026-9898

EUVD-2026-33193 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-hxqc-2xm4-r7p8

Google Information Disclosure Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:35 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers insufficient input validation in the GPU component. Chromium rates the severity High and CVSS scores it 8.3, but EPSS exploitation probability is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in Chrome's GPU process on Android, which mediates hardware-accelerated rendering between the less-privileged renderer process and the underlying graphics stack. The root cause is CWE-20 (Improper Input Validation): the GPU process accepts data from the renderer without sufficient validation, allowing a compromised renderer to send crafted messages that escape the renderer sandbox into the more privileged GPU context. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on the Android platform, consistent with Chromium's multi-process security model where renderer-to-GPU IPC is a known sandbox-escape surface.

RemediationAI

Vendor-released patch: Google Chrome for Android 148.0.7778.216 or later - update Chrome on all Android devices via Google Play to this version or newer, as referenced in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and tracked in https://issues.chromium.org/issues/496282591. Because exploitation requires the user to visit a crafted page and the renderer to be compromised first, interim compensating controls include keeping Chrome auto-updates enabled in Google Play, deploying an MDM policy to enforce a minimum Chrome version on managed Android fleet, and restricting untrusted browsing on high-value mobile devices; note that disabling hardware acceleration is not a documented mitigation for this issue and may degrade performance without reliably blocking the GPU-process path.