What is the CVSS score of CVE-2026-9945?

CVE-2026-9945 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9945?

Google Chrome on Windows versions prior to 148.0.7778.216 contains a remote code execution vulnerability in the renderer component that allows attackers to execute arbitrary code by enticing users to…. A patch is available.

How to fix or mitigate CVE-2026-9945?

Within 24 hours: Identify all Windows systems running Chrome versions prior to 148.0.7778.216; notify stakeholders of severity and patch deployment timeline. Within 7 days: Deploy Google Chrome 148.0.7778.216 or later to 100% of Windows endpoints via patch management tools; monitor deployment metrics. Within 30 days: Verify compliance through endpoint scanning; block older Chrome versions via group policy or firewall rules if feasible.

Google Chrome CVE-2026-9945

EUVD-2026-33087 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2gwr-36x9-98cq

Use After Free RCE Memory Corruption Google Microsoft Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:30 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to version 148.0.7778.216 allows attackers to execute arbitrary code within the renderer sandbox by enticing a victim to visit a crafted HTML page that triggers a use-after-free condition in the Media component. Rated High severity by Chromium with a CVSS 8.8 score, the flaw requires user interaction (visiting a malicious page) but no authentication, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free defect in Chrome's Media subsystem, which handles audio/video decoding, playback pipelines, and MediaSource/MSE/EME APIs. Use-after-free bugs occur when memory is referenced after being freed, allowing an attacker to control the contents at the dangling pointer location and ultimately hijack control flow. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the issue is specifically called out for the Windows platform, although Chromium Media code is largely cross-platform. Exploitation typically involves grooming the heap from JavaScript and triggering the freed-object reuse through crafted media elements or streams rendered inside the sandboxed renderer process.

RemediationAI

Vendor-released patch: Google Chrome Stable 148.0.7778.216 for Windows - update via Chrome's built-in updater (chrome://settings/help) or by redeploying the MSI through enterprise management, then relaunch the browser to ensure the patched binary is loaded, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprises should verify rollout via the Chrome Browser Cloud Management console or Group Policy reporting and force-restart browsers that have been running uninterrupted for extended periods. Until patching completes, compensating controls include enforcing the SitePerProcess and IsolateOrigins policies to keep renderer sandboxing strong, deploying URL-filtering or DNS controls to block untrusted sites, and disabling autoplay or media-related features via policy (AutoplayAllowed, DefaultMediaStreamSetting) - note that disabling media handling will break legitimate video/audio sites and is only a stop-gap. No standalone workaround neutralizes the use-after-free itself, so patching is the only durable fix.