What is the CVSS score of CVE-2026-9940?

CVE-2026-9940 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9940?

Google Chrome users are vulnerable to remote code execution through malicious webpages, directly threatening employee access to cloud services, email, and business applications.. A patch is available.

How to fix or mitigate CVE-2026-9940?

Within 24 hours: Identify Chrome deployment scope and verify auto-update status. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all systems; prioritize managed endpoints and enforce updates where possible. Within 30 days: Verify 100% adoption via deployment logs and endpoint telemetry.

Google Chrome CVE-2026-9940

EUVD-2026-33082 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-28 Chrome

GHSA-3ggw-gm74-wqqp

Google Heap Overflow Buffer Overflow Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:22 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows remote attackers to potentially achieve code execution within the renderer process when a victim visits a crafted HTML page. Google rated the issue High severity and has shipped a stable-channel fix; no public exploit identified at time of analysis and EPSS is currently 0.03% (10th percentile), indicating low observed exploitation interest despite the strong technical impact.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that maps WebGL and other OpenGL ES API calls onto the host platform's native graphics stack (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). The flaw is classified as CWE-122 (Heap-based Buffer Overflow), meaning attacker-controlled input - here, graphics commands or shader data parsed from a malicious page - causes a write past the bounds of a heap-allocated buffer inside ANGLE. Because ANGLE runs in-process with the renderer (and on some paths the GPU process), corruption of heap metadata or adjacent objects can be steered toward control-flow hijack or sandboxed memory disclosure, though Chrome's site-isolation and GPU sandbox still gate full system compromise.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 - update the desktop stable channel to this version or later via Chrome's built-in updater (Help → About Google Chrome), and restart the browser to complete the relaunch step that actually loads the patched ANGLE binary, as documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise fleets should push the update via Google's MSI/PKG channels or management policies and verify version reporting. If patching must be deferred, the most direct compensating control is disabling hardware-accelerated graphics (chrome://settings → System → 'Use graphics acceleration when available' off, or the HardwareAccelerationModeEnabled=false enterprise policy) to reduce ANGLE attack surface; this degrades WebGL, video decoding, and canvas performance. Additional defense in depth: block WebGL via the WebGlEnabled=false policy (breaks legitimate 3D/graphics sites), and rely on site-isolation plus URL/category filtering at the proxy to limit exposure to untrusted HTML. For Chromium derivatives, apply the corresponding vendor build that incorporates the ANGLE fix.