What is the CVSS score of CVE-2026-9905?

CVE-2026-9905 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9905?

Google Chrome for Windows (versions prior to 148.0.7778.216) contains a high-severity sandbox escape vulnerability that could allow attackers who have compromised the browser renderer process to…. A patch is available.

How to fix or mitigate CVE-2026-9905?

Within 24 hours: Identify and catalog all Windows systems running Chrome, noting current versions. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all Windows endpoints via your patch management platform. Within 30 days: Verify deployment completion and confirm no outdated versions remain in active use.

Google Chrome CVE-2026-9905

EUVD-2026-33200 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2jjr-f7gv-3rc9

Use After Free Memory Corruption Google Microsoft Denial Of Service Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:36 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free in the Accessibility component. Chromium rates the severity as High and a vendor patch is available, but no public exploit has been identified at time of analysis and EPSS exploitation probability remains very low at 0.03%.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Accessibility subsystem, which exposes the DOM and UI tree to assistive technologies and runs partially in the privileged browser process. Use-after-free conditions arise when memory is freed but a dangling pointer is later dereferenced, enabling attackers to control object contents and hijack execution flow. The affected CPE is cpe:2.3:a:google:chrome on Windows, and the bug specifically aids sandbox escape - meaning the bug crosses the renderer/browser process boundary that Chromium's site-isolation architecture is designed to enforce.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for Windows - apply by upgrading to this version or later via the Stable Channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and for managed fleets push the update through Chrome Browser Cloud Management or enterprise MSI. Administrators of Chromium-derived browsers should monitor their respective vendors for the equivalent merged fix referenced in chromium issue 498883610. If patching cannot be performed immediately, compensating controls include disabling accessibility features via the --disable-features=AccessibilityServiceURL flag or via group policy (trade-off: degrades screen-reader and assistive-technology support), enforcing site isolation and strict Enhanced Safe Browsing to reduce renderer-compromise primitives that this bug chains from, and restricting browsing to trusted sites through enterprise URL allowlists. There is no reliable network-perimeter mitigation since the trigger is a crafted HTML page over normal HTTPS traffic.