What is the CVSS score of CVE-2026-9918?

CVE-2026-9918 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9918?

Google Chrome contains a critical sandbox escape vulnerability (CVE-2026-9918) that could enable remote code execution through a malicious webpage, affecting all versions prior to 148.0.7778.216.. A patch is available.

How to fix or mitigate CVE-2026-9918?

Within 24 hours: Identify all Chrome installations and deployment mechanisms across your environment. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all user endpoints and organizational systems via your standard patch management process. Within 30 days: Verify 100% patch deployment and confirm no vulnerable versions remain in active use.

Google Chrome CVE-2026-9918

EUVD-2026-33213 CRITICAL

Improper Privilege Management (CWE-269)

2026-05-28 Chrome

GHSA-854v-w859-v99c

Privilege Escalation Google Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:38 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker to break out of the renderer sandbox via a crafted HTML page that triggers an inappropriate implementation flaw in the Tint graphics component. The issue carries a CVSS 9.6 (scope-changed) rating reflecting cross-boundary impact, requires user interaction (visiting a malicious page), and is rated High severity by Chromium; there is no public exploit identified at time of analysis and EPSS is low at 0.03%.

Technical ContextAI

Tint is the WebGPU Shading Language (WGSL) compiler and intermediate representation used inside Chrome's GPU/graphics stack (part of Dawn, Chromium's WebGPU implementation). It parses and lowers shader code supplied by web content, then forwards GPU work to the platform driver. The CWE-269 (Improper Privilege Management) classification combined with the CVSS scope-change (S:C) indicates that the inappropriate implementation in Tint allows code or operations originating in the lower-privileged renderer/GPU sandbox to influence resources or execution at a higher privilege boundary, enabling a sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms shipping the vulnerable Chrome build.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Stable channel desktop installs to this build or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html); confirm by visiting chrome://settings/help and forcing a relaunch so the patched renderer/GPU process is loaded. For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, or MDM and verify the rollout. As a temporary compensating control while patching, disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled and/or applying the WebGPU enterprise policy - this removes the Tint attack surface but breaks WebGPU-dependent sites and apps. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron-based apps) should track vendor advisories and update once the Tint fix is merged downstream.