What is the CVSS score of CVE-2026-9941?

CVE-2026-9941 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9941?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability (CVE-2026-9941, CVSS 8.8) in the ANGLE graphics component that allows unauthenticated attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-9941?

24 hours: Inventory current Chrome versions across all endpoints using enterprise management tools; validate that Chrome 148.0.7778.216 or later is available for deployment in your software distribution system. 7 days: Deploy Chrome 148.0.7778.216 or later enterprise-wide using Group Policy (Windows), JAMF (macOS), or equivalent MDM platform; prioritize systems with high-risk user roles. 30 days: Execute post-deployment audit to verify ≥99% compliance; enable automatic Chrome updates in enterprise policy to prevent regression.

Google Chrome CVE-2026-9941

EUVD-2026-33083 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-7v44-q3v7-22wm

Use After Free RCE Memory Corruption Google Denial Of Service Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:30 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome (ANGLE component) prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. The flaw is a use-after-free memory corruption issue (CWE-416) rated High severity by Chromium and CVSS 8.8, requiring only that a victim visit a malicious page. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the graphics translation layer Chromium uses to convert OpenGL ES API calls into the underlying platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and it underpins WebGL, GPU-accelerated canvas, and other browser rendering paths. The root cause class is CWE-416 (Use After Free), where memory is referenced after being freed, allowing an attacker to manipulate the freed allocation to corrupt object state, hijack a vtable or function pointer, and ultimately gain arbitrary code execution. Because ANGLE runs inside the renderer/GPU process, successful exploitation here yields code execution constrained by the Chrome sandbox; a separate sandbox-escape bug would be needed to reach full host compromise. Affected component per CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later via the Stable channel auto-update mechanism, then restart the browser to ensure the new binary is loaded - see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium issue tracker entry at https://issues.chromium.org/issues/502812366. For managed fleets, push the update through enterprise management (Chrome Browser Cloud Management, Group Policy, or Jamf/MDM) and verify version compliance. As an interim compensating control where patching is delayed, disabling hardware acceleration via chrome://settings forces a software rasterizer path that reduces ANGLE attack surface, at the cost of degraded rendering performance and battery life; site isolation should remain enabled. Users of downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) should apply each vendor's corresponding update as soon as it ships.