What is the CVSS score of CVE-2026-9927?

CVE-2026-9927 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9927?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the ANGLE graphics layer that allows attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-9927?

Within 24 hours: Inventory all Chrome deployments (Windows, macOS, Linux, mobile) and establish patch distribution timeline. Within 7 days: Deploy Chrome 148.0.7778.216 or later to achieve 90% coverage on business-critical endpoints using enterprise update tools. Within 30 days: Confirm 99% patch deployment across all platforms, enforce minimum version policies, and review security logs for exploitation indicators.

Google Chrome CVE-2026-9927

EUVD-2026-33222 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-w7g9-rwxj-fr23

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:28 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows attackers to run arbitrary code inside the browser sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free memory corruption issue (CWE-416) reported internally by the Chrome team and rated High by Chromium; no public exploit identified at time of analysis, though Chrome UAF bugs in ANGLE are historically attractive targets and pair well with sandbox escapes.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL/OpenGL ES API calls onto the host system's native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). It is reachable from any web page via WebGL or WebGPU surfaces and runs inside the GPU process. CWE-416 (Use After Free) indicates that an object's memory is referenced after it has been deallocated, allowing an attacker who controls subsequent heap allocations to coerce type confusion or function-pointer hijack and gain code execution. Because the bug lives in ANGLE inside the sandboxed GPU process, exploitation yields code execution scoped to that sandbox (S:U in the CVSS vector) rather than full host compromise unless chained with a sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade desktop installations to this version or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and restart the browser so the new binaries are loaded. Administrators managing fleets should push the update through enterprise policy (Group Policy/Jamf/MDM) and verify chrome://version on endpoints. Until patching completes, compensating controls include disabling hardware acceleration in chrome://settings (which causes ANGLE to fall back to software rendering and may avoid the vulnerable code path, at the cost of degraded WebGL/video performance) and blocking unapproved/untrusted browsing via web proxy categorization to reduce exposure to malicious HTML pages. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be updated as soon as their vendors ship the rebased build.