What is the CVSS score of CVE-2026-9904?

CVE-2026-9904 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9904?

Google Chrome contains a sandbox escape vulnerability (CVE-2026-9904, CVSS 8.3) in versions prior to 148.0.7778.216 that could allow attackers to break out of the renderer sandbox and gain…. A patch is available.

How to fix or mitigate CVE-2026-9904?

24 hours: Notify security and IT teams; prepare patch deployment communication for users and administrators. 7 days: Deploy Google Chrome 148.0.7778.216 or later across all systems; prioritize endpoints handling sensitive data. 30 days: Verify patch deployment completion; monitor threat intelligence and Chromium release notes for exploitation activity.

Google Chrome CVE-2026-9904

EUVD-2026-33199 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-wjxm-qhqx-x3p4

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:36 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free condition in the ANGLE graphics translation layer, triggered when a victim visits a crafted HTML page. Remote attackers can potentially break out of Chrome's renderer sandbox to gain broader access on the host system. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03% (11th percentile), though the Chromium team rated severity as High.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's WebGL/graphics abstraction layer that translates OpenGL ES API calls to the platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). It runs partially in the GPU process, which traditionally has weaker sandboxing than the renderer process, making ANGLE bugs particularly attractive for sandbox escape chains. The root cause is CWE-416 (Use After Free), where memory is referenced after being deallocated - in graphics code this commonly arises from object lifetime mismanagement in GL context, texture, or shader resource handling, allowing controlled memory reuse that can be leveraged for type confusion or arbitrary read/write primitives. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering desktop builds.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Chrome desktop to this version or later via the standard auto-update channel (chrome://settings/help) and relaunch the browser, as detailed in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise administrators should push the updated MSI/PKG via management tooling (GPO, Intune, Jamf) and verify deployment with Chrome Browser Cloud Management or equivalent. Until patching completes, compensating controls include disabling hardware acceleration in chrome://settings (which reduces ANGLE attack surface but degrades video/WebGL performance), enforcing strict site isolation (already default), and blocking known malicious domains at the proxy/DNS layer; for high-risk users, enabling Chrome's Enhanced Safe Browsing adds heuristic protection at the cost of additional URL telemetry to Google. Chromium downstream browsers (Edge, Brave, Opera) should be updated to their respective releases incorporating the fix.