What is the CVSS score of CVE-2026-9956?

CVE-2026-9956 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9956?

Google Chrome on iOS contains a remote code execution vulnerability (CVE-2026-9956) affecting versions prior to 148.0.7778.216 that can be triggered when users are lured to malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-9956?

Within 24 hours: Issue security alert requiring all iOS users to immediately update Chrome to version 148.0.7778.216 or later; identify and document any managed iOS devices unable to access app store updates. Within 7 days: Verify Chrome upgrade to version 148.0.7778.216 or later on 100% of managed iOS fleet. Within 30 days: Implement mandatory Chrome auto-update policy for iOS and audit historical update compliance across all iOS devices.

Google Chrome CVE-2026-9956

EUVD-2026-33098 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-qp24-9c29-mr6g

Apple Use After Free RCE Memory Corruption Google Denial Of Service Suse Red Hat Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:30 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on iOS prior to 148.0.7778.216 allows attackers to exploit a use-after-free memory corruption flaw when a victim is lured to a malicious HTML page and performs specific UI gestures. The issue carries a CVSS 7.5 (High) score with high attack complexity and required user interaction, and no public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free condition in the iOS build of Google Chrome (CPE cpe:2.3:a:google:chrome). Use-after-free flaws occur when memory is referenced after being freed, allowing attackers to potentially control freed heap regions and hijack execution flow. Chromium's security team rated this as High severity, indicating it affects the renderer or a comparable component reachable through web content rendering, and the UI:R requirement suggests the freed object is only reached through a specific user-driven interaction path in the browser UI on iOS.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 for iOS - upgrade immediately via the App Store as the primary remediation, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As Chrome on iOS uses Apple's WebKit engine for rendering due to App Store policy, organizations cannot disable the affected component without breaking the browser; if patching is delayed, restrict use of Chrome on managed iOS fleets via MDM and direct users to a fully patched alternative browser, with the trade-off being loss of Chrome-specific sync features. User-awareness guidance to avoid unfamiliar links and decline unexpected UI prompts reduces exposure given the UI:R requirement, though it is not a reliable technical control.