What is the CVSS score of CVE-2026-9922?

CVE-2026-9922 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9922?

Google Chrome on macOS prior to version 148.0.7778.216 contains a use-after-free vulnerability in the GPU process that enables sandbox escape and arbitrary code execution, affecting all macOS users…. A patch is available.

How to fix or mitigate CVE-2026-9922?

Within 24 hours: Identify and inventory all macOS endpoints running Chrome versions below 148.0.7778.216; restrict administrative use of affected systems pending patching. Within 7 days: Mandate deployment of Chrome version 148.0.7778.216 or later across all affected macOS endpoints. Within 30 days: Verify patch deployment status through asset management tools and review endpoint security logs for indicators of GPU process memory corruption or unauthorized code execution.

Google Chrome CVE-2026-9922

EUVD-2026-33217 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-phgw-f4xg-cpr8

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:28 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Renderer-to-browser sandbox escape in Google Chrome on macOS prior to 148.0.7778.216 enables remote code execution via a use-after-free in the GPU process. An attacker who has already compromised the renderer can leverage a crafted HTML page to corrupt GPU process memory and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but Chromium rates the underlying severity as High.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's GPU process, the privileged component responsible for hardware-accelerated graphics, WebGL, and compositing on macOS. Chrome's multi-process architecture isolates untrusted web content in a sandboxed renderer; the GPU process runs at a higher privilege level and communicates with renderers via Mojo IPC. A dangling pointer reached through GPU IPC messages can be reclaimed with attacker-controlled data, yielding code execution in the GPU process and effectively breaking out of the renderer sandbox. Affected CPE is cpe:2.3:a:google:chrome with the macOS build branch specifically called out by Google.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for macOS - update via Chrome's auto-update channel or by manually triggering an update under chrome://settings/help, then restart the browser to load the patched binary; see the Stable Channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the upstream issue at https://issues.chromium.org/issues/500187083. For managed fleets, push the update via MDM (Jamf, Intune, Kandji) and verify Chrome version compliance reporting. Until the patch lands, compensating controls include disabling hardware acceleration in chrome://settings (Settings → System → Use graphics acceleration when available), which removes most attack surface in the GPU process at the cost of degraded WebGL/video performance and battery life, and restricting browsing to trusted sites via enterprise policy URLBlocklist; for Chromium downstream browsers on macOS, hold off until each vendor ships the merged fix.