What is the CVSS score of CVE-2026-9954?

CVE-2026-9954 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9954?

A heap corruption vulnerability in Google Chrome's TabStrip component (CVE-2026-9954) could enable remote code execution if users are tricked into visiting malicious websites and performing specific…. A patch is available.

How to fix or mitigate CVE-2026-9954?

Within 24 hours: Inventory Chrome deployments across endpoints and identify patch delivery mechanisms (MDM, SCCM, mobile device managers). Within 7 days: Deploy Chrome 148.0.7778.216 or later to all affected systems. Within 30 days: Verify 95%+ patch compliance and configure compensating controls for any systems unable to upgrade.

Google Chrome CVE-2026-9954

EUVD-2026-33096 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-47f8-f929-prrw

Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:23 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's TabStrip component before version 148.0.7778.216 allows remote attackers to potentially achieve code execution by serving a crafted HTML page and inducing the victim to perform specific UI gestures. Chromium rates the issue High severity, but EPSS places exploitation probability at just 0.03% (11th percentile) and no public exploit identified at time of analysis, reflecting the high attack complexity and required user interaction.

Technical ContextAI

The flaw is a CWE-416 use-after-free in TabStrip, the Chrome UI component that manages browser tabs and their lifecycle. Use-after-free bugs occur when memory is referenced after being freed, allowing an attacker to reclaim that allocation with attacker-controlled data and corrupt the heap. The affected product per CPE is cpe:2.3:a:google:chrome and the bug exists in the browser process UI layer, meaning successful exploitation could escape the typical renderer sandbox boundary if the freed object is reached through UI-driven code paths.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 - upgrade Chrome desktop to this version or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, then restart the browser to apply. For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, or your MDM and verify chrome://version reflects the fixed build. No vendor workaround is published; as compensating controls until rollout completes, restrict browsing to trusted sites via enterprise URL allowlists (trade-off: breaks legitimate browsing), enforce Site Isolation (already default on desktop), and remind users that the attack requires specific UI interaction with a malicious page so phishing-awareness training reduces residual risk. Downstream Chromium browsers should be tracked separately for their respective vendor releases.