What is the CVSS score of CVE-2026-9910?

CVE-2026-9910 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9910?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the graphics rendering layer that allows attackers to execute arbitrary code through crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-9910?

Within 24 hours: Audit current Chrome versions deployed across endpoints. Within 7 days: Force deployment of Google Chrome 148.0.7778.216 or later via endpoint management tools; consider browser update policies that enforce auto-update. Within 30 days: Verify 100% deployment completion and confirm no security incidents correlate with prior versions during the unpatched window.

Google Chrome CVE-2026-9910

EUVD-2026-33205 HIGH

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-f56c-qcqf-cq94

RCE Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:29 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds memory access in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from an out-of-bounds memory access in the ANGLE graphics translation layer that lets a remote attacker run arbitrary code inside the renderer sandbox via a crafted HTML page. Chromium rates the issue High severity and a vendor patch is available, though no public exploit identified at time of analysis and the EPSS score of 0.04% (12th percentile) indicates very low observed exploitation likelihood at this time.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other OpenGL ES API calls to the host platform's native graphics APIs such as Direct3D, Metal, or Vulkan. CWE-125 (Out-of-bounds Read) in this context means the ANGLE component reads memory outside the bounds of an allocated buffer when processing attacker-controlled graphics commands originating from JavaScript/WebGL within a malicious HTML page, which Chromium classifies as enabling arbitrary code execution inside the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to the fixed Stable channel release 148.0.7778.216.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update to this Stable channel release or later, which Google distributes automatically via Chrome's built-in updater (verify by navigating to chrome://settings/help and restarting the browser to apply). Enterprises managing Chrome via Group Policy, Jamf, or Intune should accelerate the rollout of 148.0.7778.216 and confirm the update was applied across the fleet. If patching must be deferred, compensating controls include disabling hardware acceleration in chrome://settings (which reduces ANGLE's exposure to WebGL-triggered paths at the cost of slower rendering and degraded video performance) and restricting WebGL via enterprise policy 'WebGLEnabled=false' (which will break legitimate 3D and map-based web applications). Reference the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and Chromium issue https://issues.chromium.org/issues/499176133 for tracking.