What is the CVSS score of CVE-2026-9938?

CVE-2026-9938 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9938?

Google Chrome contains a critical remote code execution vulnerability in its V8 JavaScript engine (CVE-2026-9938, CVSS 8.8) that allows attackers to execute arbitrary code within the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-9938?

Within 24 hours: notify all users to enable Chrome auto-update and accept version 148.0.7778.216 or later; verify enterprise Chrome auto-update policies are active. Within 7 days: scan endpoint inventory to confirm Chrome version 148.0.7778.216+ adoption across ≥95% of fleet; manually push patches to systems with auto-update disabled. Within 30 days: complete attestation that all Chrome instances run version 148.0.7778.216 or later and document remediation evidence.

Google Chrome CVE-2026-9938

EUVD-2026-33080 HIGH

Code Injection (CWE-94)

2026-05-28 Chrome

GHSA-r26p-5p5q-3j85

Google RCE Code Injection Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:30 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. The Chromium project rates the severity as High and CVSS scores it 8.8 (network-reachable, low complexity, no privileges, user interaction required). No public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), suggesting limited near-term mass-exploitation likelihood despite the high impact rating.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine used by Chrome and Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) as well as Node.js, and it JIT-compiles untrusted script into native code. The CWE-94 (Improper Control of Generation of Code / 'Code Injection') classification, combined with the description's 'inappropriate implementation,' points to a logic or type-confusion class flaw in V8 that lets a crafted HTML/JS page coerce the engine into emitting or executing attacker-chosen native instructions inside the renderer process. Per the CPE (cpe:2.3:a:google:chrome) and EUVD data, affected builds are Chrome stable channel versions below 148.0.7778.216; importantly, the description states the resulting code execution occurs 'inside a sandbox,' meaning the bug alone yields renderer-level RCE and a separate sandbox-escape bug would be required to reach the host OS.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 on the desktop stable channel - upgrade immediately via Chrome's built-in updater (chrome://settings/help) or enterprise management (Google Chrome Enterprise MSI/policies, Jamf/Intune managed deployments) and force a browser relaunch so the V8 fix actually loads, per https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Operators of Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and Electron applications should pull the corresponding rebased build from their vendor as it ships. Until patching completes, viable compensating controls include enforcing Chrome's Site Isolation (enabled by default; verify it is not disabled via --disable-site-isolation-trials), enabling the V8 sandbox / hardware-backed renderer protections where supported, and using Chrome enterprise policies to restrict JavaScript on untrusted origins via URLBlocklist / DefaultJavaScriptSetting=2 - the trade-off is that broadly disabling JavaScript will break most modern web applications, so apply it as an allowlist on high-risk users rather than a blanket setting.