What is the CVSS score of CVE-2026-9936?

CVE-2026-9936 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9936?

Google Chrome on macOS prior to version 148.0.7778.216 contains a high-severity sandbox escape vulnerability (CVSS 8.3) enabling attackers with prior renderer process access to break out of GPU…. A patch is available.

How to fix or mitigate CVE-2026-9936?

Within 24 hours: Inventory Chrome versions across macOS fleet and confirm Chrome 148.0.7778.216+ availability via vendor channels. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all macOS systems, prioritizing high-risk users and administrative endpoints. Within 30 days: Verify patch deployment completion and monitor Chromium security advisories for confirmation of remediation status.

Google Chrome CVE-2026-9936

EUVD-2026-33078 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-xrp3-wphr-647x

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:22 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in GFX in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the GPU/GFX sandbox via a crafted HTML page, leveraging a use-after-free condition. The flaw is rated High severity by Chromium (CVSS 8.3) and requires user interaction plus a chained renderer compromise; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%).

Technical ContextAI

The vulnerability sits in Chrome's GFX (graphics) component on macOS, which handles rendering pipelines and GPU process interactions. The root cause is CWE-416 (Use After Free), a memory-corruption class where a pointer continues to be used after the underlying object has been freed, enabling attacker-controlled reuse of the memory region. Because GFX runs with broader privileges than the sandboxed renderer, a UAF here is a classic stepping stone for sandbox escape: a renderer already controlled by the attacker sends crafted graphics IPC or content that triggers the dangling reference, hijacking control flow in a less-restricted process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the Mac build line specifically called out by Google.

RemediationAI

Vendor-released patch: update Google Chrome on macOS to 148.0.7778.216 or later via the stable channel auto-updater or by relaunching the browser; the official advisory is at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and tracking is at https://issues.chromium.org/issues/502104354. In managed fleets, push the update via MDM (Jamf, Intune, Kandji) and audit installed versions with mdls/system_profiler or your endpoint inventory tool. Until patched, compensating controls are limited because the bug lives in the rendering engine itself: enable Chrome's Enhanced Safe Browsing to reduce exposure to attacker-controlled pages (trade-off: sends more browsing telemetry to Google), restrict execution of untrusted web content via site isolation policies, and consider deploying browser policy HardwareAccelerationModeEnabled=false to reduce GFX attack surface (trade-off: degrades video/canvas performance and is not a confirmed mitigation). Verify Chromium-based downstream browsers on macOS have also shipped the fix before declaring the fleet clean.