What is the CVSS score of CVE-2026-9932?

CVE-2026-9932 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9932?

Google Chrome on Windows versions prior to 148.0.7778.216 contains a sandbox escape vulnerability that enables attackers to escalate from a compromised browser process to full system access.. A patch is available.

How to fix or mitigate CVE-2026-9932?

Within 24 hours: Identify all Windows systems running Chrome and assess organizational deployment scope. Within 7 days: Begin staged rollout of Chrome 148.0.7778.216 or later, prioritizing critical systems and high-value endpoints. Within 30 days: Complete patch deployment across all Windows Chrome installations and verify version compliance.

Google Chrome CVE-2026-9932

EUVD-2026-33227 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-hwhg-7c6p-xfw2

Use After Free Memory Corruption Google Microsoft Denial Of Service Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:40 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox via a use-after-free in the ANGLE graphics layer. Exploitation requires user interaction (visiting a crafted HTML page) and a pre-existing renderer compromise, so it functions as the second stage of an exploit chain rather than a standalone RCE. No public exploit identified at time of analysis and EPSS is very low (0.03%), but Chrome rates the underlying flaw as High severity.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other OpenGL ES calls to the host platform's graphics API - on Windows this is typically Direct3D 11. Because ANGLE runs partly in the more privileged GPU process and exposes a complex interface to renderer-supplied WebGL commands, memory-safety bugs in this code path are a classic sandbox-escape vector. The root cause is CWE-416 (Use After Free): an object is freed while a pointer to it remains live, and subsequent dereference of that pointer allows an attacker who controls the heap state from a compromised renderer to corrupt memory in a more privileged process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on the Windows platform specifically.

RemediationAI

Vendor-released patch: update Google Chrome on Windows to 148.0.7778.216 or later via the Stable channel (see https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and https://nvd.nist.gov/vuln/detail/CVE-2026-9932); enterprise admins should push the update through Chrome Browser Cloud Management, Group Policy, or their endpoint-management tooling and force a browser relaunch to ensure the renderer and GPU processes actually pick up the fix. For Chromium-based browsers, install the equivalent vendor build once published. If patching must be deferred, reduce exposure by disabling WebGL (chrome://flags or policy 'Disable3DAPIs'=true), which removes the ANGLE attack surface at the cost of breaking WebGL-dependent sites and apps; site isolation and strict allowlists for risky browsing reduce but do not eliminate the chained-exploit risk. Do not rely on Windows AppContainer or EDR alone, as the bug specifically targets the sandbox boundary.