What is the CVSS score of CVE-2026-9937?

CVE-2026-9937 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9937?

Google Chrome users on Windows (versions prior to 148.0.7778.216) face a privilege escalation risk: attackers who successfully compromise the browser through malicious websites can break out of…. A patch is available.

How to fix or mitigate CVE-2026-9937?

24 hours: Inventory all Windows systems running Google Chrome, prioritizing those handling sensitive data or critical business processes. 7 days: Deploy Chrome version 148.0.7778.216 or later across all Windows endpoints via your patch management system. 30 days: Verify complete patch deployment and confirm all systems report Chrome 148.0.7778.216 or later.

Google Chrome CVE-2026-9937

EUVD-2026-33079 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-fvmq-6rjr-5xgg

Use After Free Memory Corruption Google Microsoft Denial Of Service Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:23 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a use-after-free flaw in the UI component, triggered by a crafted HTML page. Chromium rates this High severity and a vendor patch is available, though no public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile).

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in the UI subsystem of Chromium's browser process on Windows, affecting Google Chrome as identified by CPE cpe:2.3:a:google:chrome. Use-after-free conditions occur when memory is freed but a dangling pointer continues to be dereferenced, allowing an attacker to control the contents of the reused allocation and corrupt object state - frequently leveraged in Chromium exploit chains to escape the renderer sandbox into the more-privileged browser process where UI handling resides. Because UI code runs in the privileged browser process, a successful exploit crosses the sandbox security boundary that normally isolates web content.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for Windows - upgrade to this Stable channel build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. In managed environments, force the update via Google Update / Chrome Browser Cloud Management and verify chrome://settings/help reports the patched version after restart. Until users restart the browser the fix is not active, so enforce a relaunch policy (RelaunchNotification / RelaunchNotificationPeriod). If patching is temporarily blocked, compensating controls include restricting browsing to a curated allowlist via URLAllowlist/URLBlocklist policies and enabling Enhanced Safe Browsing to reduce exposure to malicious HTML payloads; note that allowlisting breaks general web use and Safe Browsing does not block targeted exploit pages, so neither substitutes for the update.