What is the CVSS score of CVE-2026-9952?

CVE-2026-9952 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9952?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the WebAudio component that allows unauthenticated attackers to execute arbitrary code in the browser…. A patch is available.

How to fix or mitigate CVE-2026-9952?

Within 24 hours: Issue urgent notification to all users and IT teams requiring immediate Chrome updates. Within 7 days: Deploy Chrome version 148.0.7778.216 or later across all organizational endpoints via standard update mechanisms or managed deployment. Within 30 days: Verify 100% patch coverage and scan for any remaining vulnerable Chrome instances.

Google Chrome CVE-2026-9952

EUVD-2026-33094 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-r3cx-3f67-3836

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:30 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's WebAudio component (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium, with a CVSS score of 8.8 reflecting low attack complexity and no authentication required, though user interaction (visiting a page) is needed. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chrome's WebAudio API, a JavaScript interface for processing and synthesizing audio in web applications, implemented in the Blink rendering engine. The root cause is CWE-416 (Use After Free), where memory is referenced after it has been freed, allowing an attacker to manipulate freed heap memory to corrupt program state and gain control of execution flow. The affected CPE is cpe:2.3:a:google:chrome (all versions prior to 148.0.7778.216), and exploitation occurs within the renderer process sandbox - meaning an additional sandbox escape would typically be required to fully compromise the host operating system.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Chrome desktop immediately via the Stable Channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Most installations will receive this automatically on browser restart; administrators managing fleets via Google Admin Console, Group Policy, or MDM should force-relaunch Chrome to guarantee the update is applied. Users of downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should monitor for and apply the equivalent vendor update once published. If patching cannot be performed immediately, compensating controls include enabling Chrome's Site Isolation (default in modern versions, provides additional renderer separation) and considering disabling JavaScript on untrusted sites via site-specific permissions - though disabling JS will break the majority of modern web applications and is only viable for restricted browsing profiles. Network-level mitigations such as blocking unknown domains via a secure web gateway can reduce drive-by exposure but will not eliminate risk from compromised legitimate sites.