What is the CVSS score of CVE-2026-9949?

CVE-2026-9949 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9949?

Google Chrome on Windows is vulnerable to a sandbox escape (CVE-2026-9949) that allows an attacker who has already compromised the browser renderer process to break out of the sandbox and potentially…. A patch is available.

How to fix or mitigate CVE-2026-9949?

Within 24 hours: Audit Chrome versions across Windows systems and test Chrome version 148.0.7778.216 or later in a staging environment. Within 7 days: Deploy Chrome 148.0.7778.216+ via your endpoint management system to all Windows devices, prioritizing systems with access to sensitive data. Within 30 days: Verify 100% deployment completion and monitor for failed updates.

Google Chrome CVE-2026-9949

EUVD-2026-33091 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-fvq4-f7h4-5849

Use After Free Memory Corruption Google Microsoft Denial Of Service Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:24 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page leveraging a use-after-free in Core. The flaw is rated High by Chromium and carries CVSS 8.3, but EPSS is very low (0.03%) and no public exploit identified at time of analysis, so it is most relevant as the second stage of a multi-bug exploit chain rather than a standalone entry vector.

Technical ContextAI

The bug is a CWE-416 use-after-free in Chrome's Core component, the browser-process logic that manages cross-process coordination between the sandboxed renderer and the more privileged browser process. Use-after-free occurs when an object is freed but a dangling pointer is later dereferenced, allowing controlled memory reuse that can be shaped into a type confusion or write primitive. Because the affected code path is reachable from a compromised renderer over Chrome's Mojo/IPC surface, a renderer that has already achieved code execution (typically through a prior renderer RCE bug) can craft IPC messages or DOM/HTML interactions that trigger the freed object's reuse in the higher-privilege process, yielding sandbox escape. CPE data scopes the affected product to cpe:2.3:a:google:chrome on Windows specifically.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 on the Windows stable channel - update via Chrome's built-in updater or push the new build through enterprise management (Google Update, Intune, SCCM) per the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Verify Chromium-based downstream browsers and apply their corresponding security updates once published. Because exploitation requires a pre-existing renderer compromise plus user interaction with a crafted page, effective compensating controls while patching include enforcing Chrome's Site Isolation (already default), enabling enterprise policies that restrict navigation to untrusted sites, and deploying browser exploit-mitigation EDR sensors; note that disabling JavaScript or sandbox-related flags is not a practical mitigation and would significantly degrade browsing functionality.