What is the CVSS score of CVE-2026-9909?

CVE-2026-9909 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9909?

Google Chrome versions prior to 148.0.7778.216 contain an integer overflow in the Skia graphics library that could allow attackers with a pre-existing renderer process compromise to execute…. A patch is available.

How to fix or mitigate CVE-2026-9909?

Within 24 hours: Verify current Chrome version across the organization and identify systems running versions prior to 148.0.7778.216. Within 7 days: Deploy Chrome version 148.0.7778.216 or later through your enterprise update mechanism. Within 30 days: Confirm 100% deployment completion through device inventory and security scans.

Google Chrome CVE-2026-9909

EUVD-2026-33204 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-9j42-wp44-pmh2

Google RCE Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:29 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome (Skia graphics library) prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to execute additional code inside the Chrome sandbox via a crafted HTML page. The flaw is an integer overflow rated High by Chromium's security team with a CVSS of 7.5, but EPSS is very low (0.04%, 12th percentile) and there is no public exploit identified at time of analysis. Exploitation requires user interaction (visiting a page) and a pre-existing renderer compromise, so this is a chain component rather than a standalone RCE.

Technical ContextAI

Skia is the open-source 2D graphics library used by Chromium (and downstream browsers like Edge, Brave, Opera, and Electron apps) to render shapes, images, text, and canvas/WebGL surfaces. CWE-472 (External Control of Assumed-Immutable Web Parameter) is unusual for a memory bug - Chrome advisories sometimes map memory-safety issues to imprecise CWEs, and the description ('integer overflow in Skia') is more consistent with a CWE-190 integer overflow leading to out-of-bounds memory access during graphics buffer sizing or allocation. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all builds prior to 148.0.7778.216 on the Stable channel; any Chromium-derived browser shipping the same Skia revision is likely affected as well.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update Chrome via the built-in updater (chrome://settings/help) or push the Stable channel update through enterprise management (Chrome Browser Cloud Management, Group Policy, or Jamf/Intune for managed endpoints) as published in https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Downstream Chromium browsers should be updated as soon as each vendor ships a build incorporating the fixed Skia revision (issue tracker: https://issues.chromium.org/issues/499152771). No official workaround is published; if patching must be delayed, compensating controls include enforcing Site Isolation (already default on desktop), keeping the Chrome sandbox enabled (do not deploy with --no-sandbox), and disabling hardware-accelerated canvas/WebGL via enterprise policy (HardwareAccelerationModeEnabled=false) - note this degrades graphics performance and breaks WebGL-dependent sites, so it should be a short-term measure only.