What is the CVSS score of CVE-2026-9916?

CVE-2026-9916 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9916?

Google Chrome contains a high-severity vulnerability in its graphics engine that could allow attackers to escape the browser sandbox and gain system-level access if the rendering process is first…. A patch is available.

How to fix or mitigate CVE-2026-9916?

Within 24 hours: Inventory all Chrome deployments and versions across managed endpoints. Within 7 days: Deploy Chrome 148.0.7778.216 or later via automatic updates or enterprise patch management. Within 30 days: Verify deployment completion across all systems and monitor security logs for exploitation indicators related to this CVE.

Google Chrome CVE-2026-9916

EUVD-2026-33211 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-535m-8qpw-vrx6

Buffer Overflow Google Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:38 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds write in the ANGLE graphics translation layer in Google Chrome before 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The flaw is rated High severity by Chromium and chained exploitation could lead to code execution outside the renderer sandbox, though no public exploit identified at time of analysis and EPSS estimates only a 0.03% near-term exploitation probability.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chrome uses to translate OpenGL ES API calls into the host platform's native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and it is reachable from web content via WebGL and related GPU-backed surfaces. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class where a write operation crosses the bounds of an allocated buffer; in ANGLE this typically stems from incorrect length validation on shader inputs, vertex arrays, or texture parameters supplied by attacker-controlled JavaScript/WebGL calls. Because ANGLE code runs inside the GPU process - which sits at a higher privilege boundary than the sandboxed renderer - corrupting its memory provides a credible primitive for sandbox escape. CPE data (cpe:2.3:a:google:chrome) confirms the affected product is the Chrome browser application.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update Chrome to 148.0.7778.216 or later via the built-in updater (chrome://settings/help) or by deploying the latest Stable channel package through your enterprise management tooling (Chrome Browser Cloud Management, Group Policy, Jamf, Intune). Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron-based apps) should be updated when their vendors ship the corresponding ANGLE backport. As a temporary compensating control until patching, you can reduce reachability of the ANGLE attack surface by disabling hardware acceleration in chrome://settings (which forces software rendering and shrinks WebGL/ANGLE code paths) or by blocking WebGL via the policy 'DefaultWebGLSetting' or the chrome://flags/#disable-webgl flag - note this will break WebGL-based applications, video conferencing effects, and some maps/3D content. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for the authoritative fix notice.