What is the CVSS score of CVE-2026-9957?

CVE-2026-9957 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9957?

Google Chrome versions prior to 148.0.7778.216 contain a use-after-free vulnerability in the PDF renderer enabling arbitrary code execution when users open malicious PDF files.. A patch is available.

How to fix or mitigate CVE-2026-9957?

24 hours: Identify Chrome version distribution across the organization and issue advisory prohibiting opening PDFs from untrusted sources. 7 days: Deploy Chrome 148.0.7778.216 or later organization-wide using managed deployment tools (Google Admin Console for enterprise or enterprise-plus deployments). 30 days: Verify deployment completion across all endpoints and configure monitoring for exploitation attempts targeting the PDF rendering component.

Google Chrome CVE-2026-9957

EUVD-2026-33099 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-57p3-53g8-w4h6

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:31 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free condition in the PDF component that remote attackers can trigger by serving a crafted PDF file. The flaw carries a CVSS 8.8 rating reflecting network reach with required user interaction (opening or rendering a malicious PDF), and no public exploit identified at time of analysis though Google rates the underlying Chromium severity as High.

Technical ContextAI

The vulnerability resides in Chrome's PDF subsystem, which is implemented via the PDFium engine embedded in the browser. CWE-416 (Use After Free) indicates that the code continues to reference a memory object after it has been freed, allowing an attacker who controls the contents of the freed-and-reallocated region to manipulate program flow - typically leading to arbitrary code execution within the renderer process. Affected CPE coverage spans cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* up to but not including the fixed build 148.0.7778.216 across desktop platforms (Windows, macOS, Linux) where Chrome ships PDFium. Because the bug lives in the renderer, exploitation is constrained by Chrome's multi-process sandbox, which is why the description explicitly notes code execution occurs 'inside a sandbox' rather than at OS-user privilege.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade all desktop Chrome installations to this version or later as published in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and trigger Chrome's built-in updater or push the MSI/PKG through enterprise management. For Chromium-derivative browsers, apply the equivalent downstream release once published. As a compensating control until patching completes, disable the built-in PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy (or chrome://settings/content/pdfDocuments) so PDFs download instead of rendering in PDFium - trade-off is degraded UX and reliance on an external PDF reader whose own vulnerabilities must be tracked. Network-level mitigations such as stripping or sandboxing PDF MIME types at the proxy can further reduce exposure but will break legitimate inline PDF workflows.