What is the CVSS score of CVE-2026-9906?

CVE-2026-9906 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9906?

Google Chrome installations are vulnerable to a sandbox escape (CVE-2026-9906) that could amplify the impact of a browser-based attack by allowing a compromised renderer process to gain system-level…. A patch is available.

How to fix or mitigate CVE-2026-9906?

Within 24 hours: Inventory Chrome versions and identify deployment scope across endpoints. Within 7 days: Deploy Chrome 148.0.7778.216 or later using your standard patch management process; prioritize systems handling sensitive data or with high exposure to untrusted content. Within 30 days: Verify patch compliance through endpoint monitoring and audit a sample of systems to confirm successful deployment.

Google Chrome CVE-2026-9906

EUVD-2026-33201 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-j4xq-8gjf-26vv

Google Memory Corruption Buffer Overflow Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:37 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome before 148.0.7778.216 enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox through an out-of-bounds write in the GPU process triggered by a crafted HTML page. Google rates the Chromium security severity as High and a vendor patch is available, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low at 0.03% (11th percentile).

Technical ContextAI

The flaw lives in Chrome's GPU process, the privileged broker that handles graphics commands relayed from sandboxed renderers via Chrome's IPC/Mojo channels. CWE-787 (Out-of-bounds Write) indicates memory corruption where attacker-controlled data is written past the bounds of an allocated buffer inside the GPU process, corrupting adjacent memory and enabling control-flow hijack or data corruption that breaks the renderer-to-GPU trust boundary. Per the CPE (cpe:2.3:a:google:chrome) all Chrome desktop builds prior to 148.0.7778.216 are in scope, and exploitation requires the attacker to have first achieved code execution inside the lower-privileged renderer - making this a classic second-stage primitive in a Chrome exploit chain rather than a standalone RCE.

RemediationAI

Vendor-released patch: Chrome Stable 148.0.7778.216 - upgrade Chrome on Windows, macOS, and Linux to 148.0.7778.216 or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and verify deployment through Chrome's About page or enterprise update management. Confirm Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and embedded Chromium runtimes (Electron, CEF) have absorbed the upstream fix before considering them remediated. As compensating controls until patching completes, enable Chrome's Site Isolation (default) and Strict Site Isolation enterprise policy to keep cross-site renderers separated, deploy the Enhanced Safe Browsing policy to harden against drive-by HTML lures, and for high-risk users consider the chrome://flags 'GPU sandbox' hardening or temporarily disabling hardware acceleration (with the side effect of degraded rendering/video performance) to reduce exposure of the vulnerable GPU process path; restrict execution to managed-extension allowlists to lower the odds of a renderer-stage compromise that this bug would chain from.