What is the CVSS score of CVE-2026-9947?

CVE-2026-9947 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9947?

Google Chrome versions prior to 148.0.7778.216 contain a critical use-after-free vulnerability allowing remote code execution when users visit malicious websites, potentially exposing workstations to…. A patch is available.

How to fix or mitigate CVE-2026-9947?

24 hours: Declare patch deployment urgent priority; notify all IT staff and system administrators that Chrome 148.0.7778.216 or later must be deployed. 7 days: Deploy Chrome 148.0.7778.216 or later to 80%+ of user base via centralized update mechanisms (Group Policy, MDM, or mobile device management) and monitor compliance. 30 days: Verify 95%+ of all Chrome instances are running 148.0.7778.216 or later; retire or rebuild any systems remaining on vulnerable versions.

Google Chrome CVE-2026-9947

EUVD-2026-33089 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-xwqp-vx4g-wqcc

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:30 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free flaw in the browser's XML handling component, allowing a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. Chromium rates the severity as High with a CVSS 3.1 score of 8.8, and exploitation requires user interaction such as visiting a malicious site. No public exploit identified at time of analysis, but use-after-free flaws in Chrome's XML parsing have historically been chained with sandbox escapes for full system compromise.

Technical ContextAI

The vulnerability resides in Chrome's XML processing subsystem, which handles parsing and manipulation of XML documents embedded or referenced within web content. The root cause is CWE-416 (Use After Free), a memory corruption class where an object is freed but a dangling pointer is subsequently dereferenced, allowing an attacker who can influence memory layout to control the contents of the freed-then-reused region. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome installations prior to the fixed build. Although Chrome's multi-process architecture and site isolation contain initial execution within the renderer sandbox, such bugs are common stepping stones in exploit chains that pair a renderer RCE with a sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (stable channel), available per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html - upgrade all desktop Chrome installations to this version or later by triggering chrome://settings/help and restarting the browser, or by deploying via enterprise management tooling (Google Update, Chrome Browser Cloud Management, MDM). Users of Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) should monitor their respective vendor channels for downstream releases incorporating the fix. If immediate patching is not feasible, compensating controls include enforcing strict site isolation (already on by default), enabling Enhanced Safe Browsing to block known malicious pages, and restricting browsing to a curated allowlist via enterprise policy URLAllowlist/URLBlocklist - note these reduce but do not eliminate exposure since drive-by exploitation can occur on any compromised legitimate site. The Chromium tracker entry https://issues.chromium.org/issues/503627446 will likely remain access-restricted until broad patch adoption.