What is the CVSS score of CVE-2026-9900?

CVE-2026-9900 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9900?

Google Chrome versions before 148.0.7778.216 contain a sandbox escape vulnerability in the ANGLE graphics layer that could allow attackers to execute arbitrary code if the renderer process has been…. A patch is available.

How to fix or mitigate CVE-2026-9900?

Within 24 hours: Inventory all Chrome deployments and identify affected versions. Within 7 days: Develop and validate a patch deployment plan targeting Chrome 148.0.7778.216 or later across all managed endpoints. Within 30 days: Complete full rollout of the patched Chrome version.

Google Chrome CVE-2026-9900

EUVD-2026-33195 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-mcvq-rh64-88v2

Google Memory Corruption Buffer Overflow Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:35 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.3, the issue is patched but no public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.03%, 11th percentile).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chrome uses to translate OpenGL ES API calls into the underlying graphics API of the host platform (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). It is invoked from the renderer process whenever WebGL, WebGPU, or canvas-accelerated content is rendered. The root cause is CWE-787 (Out-of-Bounds Write) - a memory corruption primitive in ANGLE's processing of graphics commands. Because ANGLE runs in the GPU process boundary that the renderer can interact with, a controlled out-of-bounds write here gives an already-compromised renderer a route to corrupt memory in a more privileged process, enabling sandbox escape. CPE coverage is broad (cpe:2.3:a:google:chrome:*) reflecting that all Chrome desktop builds prior to the fix are affected.

RemediationAI

Vendor-released patch: Chrome Stable 148.0.7778.216 - upgrade to this version or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. In managed environments, force update via Chrome Browser Cloud Management or the relevant policy (RelaunchNotification) to ensure users restart and pick up the fix. For Chromium-based browsers, apply the corresponding vendor build that incorporates the upstream ANGLE fix. As an interim compensating control where patching is delayed, disabling hardware acceleration in chrome://settings reduces ANGLE attack surface for many code paths, at the cost of degraded WebGL/WebGPU performance and broken graphics in some sites; alternatively, blocking WebGL via enterprise policy (HardwareAccelerationModeEnabled=false or site-specific WebGL policy) shrinks exposure but breaks legitimate 3D and canvas-accelerated content.