What is the CVSS score of CVE-2026-9948?

CVE-2026-9948 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9948?

Google Chrome on macOS contains a sandbox escape vulnerability (CVE-2026-9948) that could allow an attacker with prior renderer process control to escalate to system-level access.. A patch is available.

How to fix or mitigate CVE-2026-9948?

Within 24 hours: Audit Chrome installations across macOS endpoints and document current versions. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all affected macOS systems via your standard patch management workflow. Within 30 days: Validate 100% patch compliance and maintain records of deployment completion.

Google Chrome CVE-2026-9948

EUVD-2026-33090 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-r8vc-287h-hwxg

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:40 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Views in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS before 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the Views UI component. The flaw is rated High severity by Chromium and carries a CVSS 8.3 due to scope change, but EPSS is only 0.03% and there is no public exploit identified at time of analysis. Exploitation is realistic only as the second stage of a chained renderer compromise rather than a standalone drive-by attack.

Technical ContextAI

Views is Chromium's cross-platform UI framework that runs in the privileged browser process and renders browser chrome (tabs, menus, dialogs) using its own widget and event-dispatch system. CWE-416 (Use After Free) here means an object in the Views subsystem is freed while a dangling pointer remains reachable, and reusing that pointer allows controlled memory contents to be interpreted as a live object - yielding type confusion or arbitrary call primitives inside the browser process. Because Views lives outside the renderer sandbox, a successful UAF triggered through IPC from a compromised renderer effectively bridges the renderer/browser trust boundary. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* matches all Chrome builds, but the description scopes impact specifically to the macOS build prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 for macOS - upgrade immediately via Chrome's stable channel auto-update or by forcing a relaunch through enterprise management (Jamf, Intune, Workspace ONE) and verifying the build under chrome://version. No vendor-published workaround exists because the defect is in core Views code, but because exploitation requires a prior renderer compromise, compensating controls that reduce renderer exposure are meaningful: enforce Site Isolation (already default), disable unneeded experimental features via the SitePerProcess and IsolateOrigins enterprise policies, and restrict installation of untrusted extensions which are a common renderer-compromise vector. Reference the Chrome Releases stable-channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium issue tracker entry at https://issues.chromium.org/issues/503790201; note that aggressive policy lockdown can break legitimate web apps that rely on cross-origin features, so stage policy changes after the patch is deployed.