What is the CVSS score of CVE-2026-9923?

CVE-2026-9923 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9923?

Google Chrome versions prior to 148.0.7778.216 contain a heap corruption vulnerability in the Skia graphics library that can compromise systems when users visit malicious websites, exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-9923?

Within 24 hours: Issue security alert to all Chrome users and IT staff regarding the vulnerability and available patch. Within 7 days: Deploy Chrome version 148.0.7778.216 or later across all endpoints using managed deployment tools. Within 30 days: Complete audit to verify deployment completion and confirm zero instances of vulnerable Chrome versions remain in use.

Google Chrome CVE-2026-9923

EUVD-2026-33218 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-f2f4-mp7w-9jr4

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:22 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Skia graphics library affects all versions prior to 148.0.7778.216 and can be triggered by a remote attacker hosting a crafted HTML page. Successful exploitation requires user interaction (visiting the page) but yields high confidentiality, integrity, and availability impact within the renderer context. No public exploit is identified at time of analysis and EPSS is very low (0.03%), though Chromium rates the severity as High and a vendor patch is available.

Technical ContextAI

Skia is the open-source 2D graphics library used by Chromium (and downstream browsers such as Edge, Brave, Opera, and Electron-based apps) to rasterize HTML/CSS, Canvas, and WebGL content. The root cause is a CWE-416 Use-After-Free: Skia code retains a pointer to a graphics object after its backing memory has been freed, and a crafted HTML page can drive the renderer to dereference that dangling pointer, leading to heap corruption that an attacker can shape into arbitrary read/write or control-flow hijack inside the sandboxed renderer process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with fixed code shipped in Chrome stable 148.0.7778.216.

RemediationAI

Vendor-released patch: Chrome stable 148.0.7778.216 - update Chrome via the standard auto-update flow or by forcing a relaunch from chrome://settings/help, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, push the update via Group Policy / MDM and verify version compliance with chrome://version or endpoint inventory. Downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) and Electron applications should be updated as soon as their respective vendors ship the merged Skia fix. Until updates roll out, compensating controls include restricting browsing to trusted sites via enterprise URL allow-lists, enabling Chrome's Enhanced Safe Browsing (which adds renderer-side protections at the cost of sending more URL telemetry to Google), and considering site-isolation already-on defaults - note these reduce but do not eliminate exposure since the bug triggers from any rendered HTML.