What is the CVSS score of CVE-2026-9926?

CVE-2026-9926 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9926?

Google Chrome prior to version 148.0.7778.216 contains a critical privilege escalation vulnerability in its graphics subsystem that could allow attackers to transition from browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-9926?

Within 24 hours: Audit Chrome deployment across all corporate endpoints to identify versions below 148.0.7778.216. Within 7 days: Deploy Chrome 148.0.7778.216 or later through enterprise distribution mechanisms. Within 30 days: Validate 100% deployment completion and flag any non-compliant systems for manual remediation.

Google Chrome CVE-2026-9926

EUVD-2026-33221 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-28 Chrome

GHSA-vx82-vfm4-gj2q

Buffer Overflow Google Heap Overflow

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:39 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 leverages a heap buffer overflow in the ANGLE graphics translation layer, enabling attackers who have already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Chromium rates the severity as High and CVSS scores it at 8.3, though EPSS remains very low at 0.03% and no public exploit has been identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the cross-platform graphics abstraction library Chromium uses to translate OpenGL ES API calls into the native graphics APIs of the host platform (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE processes complex graphics command streams from web content and runs partially within privileged GPU/browser process contexts, memory safety bugs there are a well-known sandbox escape surface. The root cause is CWE-122 (Heap-based Buffer Overflow), where insufficient bounds checking on heap-allocated graphics buffers allows an attacker controlling renderer-process inputs to corrupt adjacent heap memory in a more-privileged process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to the fixed release.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 on the Stable channel - upgrade all desktop Chrome installations to this version or later, as documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed environments, force a browser relaunch via enterprise policy (RelaunchNotification / RelaunchNotificationPeriod) rather than waiting on user-initiated restarts, since the fix only loads after the browser process restarts. Track downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) and update them as their respective vendors ship the ANGLE fix. As a temporary compensating control where patching is delayed, organizations can disable hardware-accelerated graphics via the DisableHardwareAcceleration enterprise policy or the --disable-gpu flag to reduce ANGLE attack surface - trade-off is degraded rendering performance and broken WebGL/WebGPU functionality for users. Browser-isolation or sandboxed RBI deployments also reduce host impact even if exploitation succeeds.