What is the CVSS score of CVE-2026-9914?

CVE-2026-9914 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9914?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability (CVE-2026-9914, CVSS 8.3) that could permit an attacker to break out of the browser's isolation and gain…. A patch is available.

How to fix or mitigate CVE-2026-9914?

Within 24 hours: Identify all Chrome deployments and versions in use across the organization. Within 7 days: Deploy Google Chrome 148.0.7778.216 or later to all endpoints through your standard patch management process; prioritize systems with internet-facing roles. Within 30 days: Audit patch deployment completion and remediate any systems unable to update to the fixed version.

Google Chrome CVE-2026-9914

EUVD-2026-33209 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-wfqh-vwwq-cg8p

Google Information Disclosure Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:37 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page exploiting insufficient input validation in the ANGLE graphics layer. The flaw carries a CVSS 8.3 (High) rating with scope change and full CIA impact, but EPSS is very low at 0.05% (15th percentile) and there is no public exploit identified at time of analysis. Chrome's security team rated this High severity and a patched stable channel build is available.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL and other OpenGL ES calls to the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE code runs in the more privileged GPU process rather than the renderer sandbox, a renderer that can feed malformed graphics commands to ANGLE has a recognized path toward sandbox escape. The root cause is CWE-20 (Improper Input Validation): untrusted data received by ANGLE from a compromised renderer is not sufficiently sanitized, allowing crafted HTML/WebGL content to drive ANGLE into an exploitable state. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome installations on supported desktop platforms below the fixed build are in scope.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (Stable channel) - update Chrome on all desktop endpoints to this version or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprises managing Chrome via policy should force-restart browsers after deployment so the new binaries actually load, and should also track and patch any Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and Electron applications used in the environment. If patching cannot be performed immediately, the most direct compensating control is to disable hardware-accelerated graphics and WebGL via enterprise policy (HardwareAccelerationModeEnabled=false, WebGLEnabled=false), which removes most of the ANGLE attack surface but will degrade performance for video, maps, and graphics-heavy web apps; site isolation should remain enabled, and Site Engagement / safe-browsing restrictions can further limit exposure to untrusted pages.