What is the CVSS score of CVE-2026-9924?

CVE-2026-9924 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9924?

A sandbox escape vulnerability in Google Chrome for Windows (CVE-2026-9924, CVSS 8.3) could allow attackers to gain elevated system access from within the browser, potentially affecting all Windows…. A patch is available.

How to fix or mitigate CVE-2026-9924?

Within 24 hours: Inventory Chrome versions across Windows endpoints using device management tools; Within 7 days: Deploy Chrome 148.0.7778.216 or later via automatic updates or forced distribution through Group Policy/MDM; Within 30 days: Verify 100% endpoint compliance with the patched version through inventory or vulnerability scanning.

Google Chrome CVE-2026-9924

EUVD-2026-33219 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-28 Chrome

GHSA-46cv-4fgx-p89x

Google Heap Overflow Microsoft Buffer Overflow Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:39 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 148.0.7778.216 lets a remote attacker who has already compromised the renderer process break out of the Chrome sandbox via a crafted HTML page that triggers a heap buffer overflow in ANGLE. The flaw carries CVSS 8.3 (High) and is rated Chromium-severity High, but EPSS is only 0.03% and there is no public exploit identified at time of analysis. Patched in the Stable channel update announced by Google on the Chrome Releases blog.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other OpenGL ES API calls onto the underlying platform graphics stack - on Windows it typically backs onto Direct3D. Because ANGLE runs inside the GPU/renderer process and parses attacker-influenced graphics commands originating from JavaScript/WebGL, memory-safety bugs in it are a classic pivot point from a compromised renderer into higher-privileged Chrome processes. The root cause is CWE-122 (Heap-based Buffer Overflow), meaning an out-of-bounds write into heap memory that an attacker can shape via crafted graphics state or shaders to corrupt adjacent objects and gain code execution outside the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the Windows build as the platform of concern per the description.

RemediationAI

Update Google Chrome on Windows to Vendor-released patch: 148.0.7778.216 or later via the Stable channel; Chrome's auto-updater will deliver this on restart, so the operational step in managed environments is to enforce a browser relaunch rather than rely on background update. Track Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding rebased releases as they ship. If patching must be deferred, the realistic compensating control is to disable hardware-accelerated graphics in Chrome (chrome://settings → System → 'Use hardware acceleration when available' off, or the HardwareAccelerationModeEnabled enterprise policy) which forces ANGLE down a software path and reduces, though does not eliminate, the attack surface - the trade-off is degraded WebGL/Canvas performance and battery life. Site Isolation should already be enabled (default) to limit renderer compromise blast radius, and high-risk users can be moved to a stricter browsing profile until patches roll out. Reference: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html.