What is the CVSS score of CVE-2026-9901?

CVE-2026-9901 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9901?

A use-after-free vulnerability in Google Chrome's ANGLE graphics layer (CVE-2026-9901) enables attackers who have compromised the renderer process to escape the browser sandbox and execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-9901?

Within 24 hours: Identify and inventory all Chrome deployments and document current version distribution. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all endpoints via standard patch management, prioritizing systems with internet-facing browsing requirements. Within 30 days: Verify 100% of vulnerable instances have been updated and confirm via endpoint telemetry that no systems remain on versions prior to 148.0.7778.216.

Google Chrome CVE-2026-9901

EUVD-2026-33196 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-6v49-gf9m-36r2

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:28 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape and arbitrary code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free flaw in the ANGLE graphics translation layer. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break memory safety and execute code in a higher-privileged context. No public exploit identified at time of analysis, though Chromium rates the underlying severity as High.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's abstraction library that translates OpenGL ES API calls into native graphics APIs such as Direct3D, Metal, or Vulkan, enabling consistent WebGL and GPU-accelerated rendering across platforms. The root cause is CWE-416 (Use After Free), a memory corruption class in which an object is referenced after its backing memory has been released, allowing an attacker to manipulate the freed region - typically via heap grooming - to hijack control flow or corrupt adjacent data. Because ANGLE operates at the boundary between renderer-supplied graphics commands and the host GPU stack, a UAF here is particularly impactful for chaining out of the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all builds prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Chrome to this version or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and verify via chrome://settings/help that the build is current. For managed fleets, push the update through Chrome Browser Cloud Management, Group Policy, or MDM and force a relaunch to ensure the patched ANGLE binary is loaded. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and Electron-bundled applications should track and apply their respective downstream releases that integrate the fix. As a temporary compensating control before patching, GPU acceleration and WebGL can be disabled via the --disable-gpu and --disable-webgl flags or enterprise policies HardwareAccelerationModeEnabled=false and Disable3DAPIs=true, which removes the ANGLE attack surface at the cost of degraded rendering performance and broken WebGL-dependent sites; site isolation should also be left enabled (SitePerProcess) since it raises the bar for renderer compromise, which is the stated prerequisite for this bug.