What is the CVSS score of CVE-2026-9931?

CVE-2026-9931 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9931?

Google Chrome prior to version 148.0.7778.216 contains a sandbox escape vulnerability (CVE-2026-9931, CVSS 8.3) that allows attackers with renderer process access to gain complete system control-no…. A patch is available.

How to fix or mitigate CVE-2026-9931?

Within 24 hours: Audit Chrome version inventory across all managed endpoints to identify systems running versions below 148.0.7778.216. Within 7 days: Deploy Chrome version 148.0.7778.216 or later organization-wide via auto-update settings, group policy (Windows), or MDM enrollment (macOS/Linux). Within 30 days: Confirm 100% patch compliance through your patch management dashboard and establish alerting for future Chromium stable-channel security updates.

Google Chrome CVE-2026-9931

EUVD-2026-33226 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-g47m-4639-x932

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:40 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's GPU process prior to version 148.0.7778.216 lets a remote attacker who has already gained code execution inside the renderer process break out of Chrome's sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and carries CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C). EPSS is very low (0.03%), and there is no public exploit identified at time of analysis, but the bug is part of a stable-channel security release shipped by Google.

Technical ContextAI

The vulnerability lives in Chrome's GPU process, the privileged component that handles graphics commands proxied from sandboxed renderers via Mojo IPC. A use-after-free (CWE-416) occurs when an object is freed while another reference is still held and later dereferenced; in the GPU process this typically yields a controllable type confusion or call through a stale vtable, which exploit writers convert into arbitrary read/write and finally code execution outside the renderer sandbox. The affected codebase is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and corresponds to all Chrome desktop builds before 148.0.7778.216 across the Blink/Chromium GPU pipeline, where renderer-to-GPU IPC is the cross-trust-boundary that makes this a sandbox-escape primitive rather than a pure renderer bug.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (stable channel) - update Chrome on all desktop endpoints to that version or later per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and verify rollout via your management console (Chrome Browser Cloud Management, Group Policy, or MDM). For Chromium-based browsers, apply the equivalent Chromium 148.0.7778.216 baseline update once the downstream vendor publishes it. If patching must be deferred, disable hardware-accelerated GPU rasterization and WebGPU via the 'HardwareAccelerationModeEnabled' policy set to false and disable WebGL through enterprise policy to shrink the GPU-process attack surface (trade-off: degraded video, canvas, and 3D performance and broken WebGL/WebGPU sites); additionally enforce site isolation, restrict browsing of untrusted content via proxy/URL filtering, and ensure the renderer-side primitive an attacker would need is mitigated by keeping V8 sandbox and site isolation enabled. Track the upstream issue at https://issues.chromium.org/issues/501524262 and the EUVD listing https://nvd.nist.gov/vuln/detail/CVE-2026-9931.