What is the CVSS score of CVE-2026-9946?

CVE-2026-9946 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9946?

Google Chrome versions prior to 148.0.7778.216 contain a use-after-free vulnerability in the ANGLE graphics translation layer (CVE-2026-9946) enabling sandbox escape for attackers with renderer…. A patch is available.

How to fix or mitigate CVE-2026-9946?

Within 24 hours: Inventory Chrome installations across the organization and verify automatic update enablement. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all systems, prioritizing user-facing and high-risk endpoints. Within 30 days: Confirm patch deployment via endpoint management tools and review system logs for abnormal renderer process activity.

Google Chrome CVE-2026-9946

EUVD-2026-33088 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-p89g-x367-23hf

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:24 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free condition in the ANGLE graphics translation layer that lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Google rates this High severity and a vendor patch is available, but EPSS scoring (0.03%, 11th percentile) is low and no public exploit identified at time of analysis, suggesting it has not yet been weaponized broadly.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction that translates OpenGL ES API calls into the underlying platform's native graphics API (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux), and it runs partially inside the GPU process that the renderer interacts with. The root cause is CWE-416 (Use After Free), meaning ANGLE retains or dereferences a pointer to memory that has already been freed, allowing controlled memory reuse that can corrupt object state crossing the renderer/GPU trust boundary. Per the CPE data, all Google Chrome builds (cpe:2.3:a:google:chrome:*) before 148.0.7778.216 are affected, and the vulnerability is exploitable through HTML/WebGL content rendered by the browser.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update Chrome to this build or later via the Stable Channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and restart the browser to apply the fix. For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, or your endpoint manager and verify version compliance. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and Electron applications should track their vendors' corresponding releases that incorporate the Chromium fix. As a compensating control until patched, enabling Chrome's Site Isolation (on by default) and Strict Site Isolation provides additional renderer separation, and deploying enterprise policies to disable WebGL (HardwareAccelerationModeEnabled or WebGL via WebGLConfiguration policy) reduces ANGLE attack surface at the cost of breaking 3D, hardware-accelerated canvas, and many web apps that depend on GPU rendering.