What is the CVSS score of CVE-2026-9958?

CVE-2026-9958 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9958?

Google Chrome versions before 148.0.7778.216 contain a critical heap corruption flaw in PDF rendering that could allow attackers to execute code in the browser when users open malicious PDFs.. A patch is available.

How to fix or mitigate CVE-2026-9958?

Within 24 hours: Notify users of the vulnerability and verify Chrome version inventory in your infrastructure. Within 7 days: Deploy Chrome version 148.0.7778.216 or later across all systems using your standard update mechanism (Windows Update, WSUS, MDM, or manual deployment). Within 30 days: Audit deployment completion through endpoint configuration management; identify and remediate any non-compliant systems with enforced patching or user device policies.

Google Chrome CVE-2026-9958

EUVD-2026-33100 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2wcg-7wr3-q72q

Google Use After Free Denial Of Service Memory Corruption Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:23 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's PDFium component before version 148.0.7778.216 lets a remote attacker trigger a use-after-free condition by serving a crafted PDF, opening the door to code execution within the renderer process. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (UI:R) to open or render the malicious document. EPSS is currently very low (0.03%, 11th percentile) and no public exploit has been identified at time of analysis, though Chrome PDFium UAFs have a long history of weaponization in browser exploit chains.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers (Chrome, Edge, Brave, Opera, etc.) and is responsible for parsing and displaying PDF documents in the browser's renderer process. The root cause class is CWE-416 (Use After Free), where memory is referenced after it has been released back to the heap allocator, allowing an attacker who controls subsequent allocations to manipulate the freed object's contents and corrupt PDFium's internal state. The affected CPE is cpe:2.3:a:google:chrome and impacts builds prior to 148.0.7778.216 on the Stable channel. Successful exploitation typically yields code execution inside the sandboxed renderer, which historically has been paired with a sandbox escape to achieve full system compromise.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 148.0.7778.216 or later on the Stable Desktop channel per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html; most managed deployments will receive this automatically via Chrome's update channel, but verify via chrome://settings/help and force a relaunch on endpoints with delayed updates. Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and embedded engines (Electron, CEF) should be updated as their vendors merge the PDFium fix. As a compensating control until patching completes, administrators can disable the built-in PDF viewer via the AlwaysOpenPdfExternally enterprise policy so PDFs download instead of rendering in-browser (trade-off: degrades UX and shifts risk to whatever external PDF handler users have installed), or block PDF MIME types at the web proxy for high-risk user groups (trade-off: breaks legitimate workflows that rely on inline PDF viewing). Standard browser hardening - site isolation, strict download prompts, and EDR rules flagging renderer-spawned child processes - also reduces but does not eliminate the exposure window.