What is the CVSS score of CVE-2026-9928?

CVE-2026-9928 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9928?

Google Chrome for Windows users face a critical remote code execution vulnerability that could allow attackers to compromise systems when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-9928?

Within 24 hours: Issue security alert directing all staff to update Chrome immediately. Within 7 days: Deploy Google Chrome 148.0.7778.216 or later to all Windows endpoints via your standard deployment mechanisms (Intune, SCCM, or native updates). Within 30 days: Verify patch deployment across all Windows systems and confirm zero devices remain on vulnerable versions prior to 148.0.7778.216.

Google Chrome CVE-2026-9928

EUVD-2026-33223 HIGH

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-6vcf-c3pr-g749

RCE Buffer Overflow Information Disclosure Google Microsoft

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:29 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome for Windows prior to 148.0.7778.216 stems from an out-of-bounds read in the ANGLE graphics abstraction layer, enabling attackers who lure a user to a malicious page to execute arbitrary code in the renderer context. Chromium rates the severity High and CVSS scores it 8.8 due to network reach and high impact across confidentiality, integrity, and availability, though successful exploitation requires user interaction (visiting the crafted page). No public exploit has been identified at time of analysis, but ANGLE bugs have historically been chained into browser sandbox escapes.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that converts OpenGL ES API calls - used by WebGL and other GPU-accelerated web content - into native Direct3D calls on Windows. The CWE-125 classification indicates an out-of-bounds read in this component, meaning malformed graphics commands (likely via WebGL shaders, textures, or draw calls) can cause ANGLE to read memory outside an allocated buffer. In Chrome's multi-process architecture, ANGLE runs in the GPU process, so an OOB read here can leak memory contents or be paired with corruption primitives to achieve code execution, as reflected in the C:H/I:H/A:H impact metrics. The affected CPE is cpe:2.3:a:google:chrome with the Windows platform explicitly called out in the description.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 on the Windows stable channel - upgrade immediately via Chrome's auto-update mechanism or by enforcing the update through enterprise management (chrome://settings/help to verify, or Google Update / Chrome Browser Cloud Management for fleets), referencing the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For environments where the patch cannot be deployed immediately, compensating controls include disabling hardware-accelerated WebGL via the policy 'HardwareAccelerationModeEnabled=false' or the chrome://flags WebGL toggle (trade-off: noticeably degraded performance on graphics-heavy sites and broken functionality for WebGL-dependent applications like maps, 3D viewers, and some video conferencing tools), and restricting browsing to known-safe sites via SafeSites or proxy-level allowlisting until updates land. Chromium-based browsers downstream (Edge, Brave, Opera, Vivaldi) should also be checked for matching upstream updates that incorporate the ANGLE fix.