What is the CVSS score of CVE-2026-9915?

CVE-2026-9915 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9915?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability that could enable attackers to escalate from a compromised browser process to full system access.. A patch is available.

How to fix or mitigate CVE-2026-9915?

Within 24 hours: Identify all Chrome deployments and prioritize devices running versions prior to 148.0.7778.216. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all user devices and servers. Within 30 days: Confirm 100% patch deployment and monitor for any failed updates or delayed systems.

Google Chrome CVE-2026-9915

EUVD-2026-33210 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-28 Chrome

GHSA-w6vr-9fph-gm3v

Buffer Overflow Google Heap Overflow

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:37 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with CVSS 8.3 (scope-changed) and CWE-122 heap buffer overflow; no public exploit identified at time of analysis and EPSS is very low (0.03%), but the vulnerability is in the second-stage chain typically combined with a renderer RCE.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other GPU API calls to the host platform's native graphics backend (Direct3D, Metal, Vulkan, OpenGL). Because ANGLE processes attacker-influenced shader and graphics data and runs in a more privileged GPU/browser process boundary, memory-corruption bugs in it are a recurring vector for sandbox escapes from the compromised renderer. CWE-122 (heap buffer overflow) here means out-of-bounds writes on the heap within ANGLE, which an attacker who already controls the renderer can leverage to corrupt memory in a higher-privileged process and escape Chrome's sandbox. The CPE confirms the affected component is Google Chrome (cpe:2.3:a:google:chrome).

RemediationAI

Update Google Chrome to version 148.0.7778.216 or later on all desktop platforms - Vendor-released patch: 148.0.7778.216, distributed through the Chrome stable channel as described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Enterprise environments should force an update via Chrome Browser Cloud Management or group policy and verify versions via chrome://version. Embedders that ship Chromium-derived browsers (Edge, Brave, Opera, Electron) should track their respective upstream releases incorporating the ANGLE fix. As an interim compensating control on systems that cannot be patched immediately, disabling hardware-accelerated WebGL/GPU via the --disable-webgl or --disable-gpu flags reduces exposure to ANGLE-pathway exploitation but degrades graphics performance and may break legitimate WebGL applications; site isolation should remain enabled to preserve the renderer/GPU process boundary.