What is the CVSS score of CVE-2026-9961?

CVE-2026-9961 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9961?

Google Chrome versions prior to 148.0.7778.216 contain a heap corruption vulnerability in the SurfaceCapture component that permits remote code execution when users visit attacker-controlled…. A patch is available.

How to fix or mitigate CVE-2026-9961?

Within 24 hours: confirm auto-update status across your Chrome deployments and identify any devices pinned to older versions. Within 7 days: push Chrome 148.0.7778.216 or later to all managed endpoints via your deployment tool (Group Policy, Jamf, etc.); prioritize corporate-managed devices. Within 30 days: verify compliance rates via MDM telemetry and enforce mandatory updates on any holdouts.

Google Chrome CVE-2026-9961

EUVD-2026-33103 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-qhc5-4jrr-hwc9

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:23 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's SurfaceCapture component (versions prior to 148.0.7778.216) allows a remote attacker to potentially execute arbitrary code by luring a user to a crafted HTML page. The flaw is a use-after-free issue rated High severity by the Chromium project, with a CVSS score of 8.8 reflecting low complexity and no authentication, though user interaction is required. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 11th percentile), but the historical pattern of Chrome UAF bugs being weaponized makes patching urgent.

Technical ContextAI

The vulnerability resides in SurfaceCapture, a Chromium component associated with the capture pipeline used to render and composite surfaces (related to screen/tab/window capture and Viz/compositor surface handling). The root cause is CWE-416 (Use-After-Free), where memory is referenced after it has been freed, allowing an attacker who controls heap layout and timing through a crafted HTML page to corrupt the heap and potentially redirect control flow. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - Google Chrome desktop - and the fix is shipped in the Stable channel update referenced by the Chrome Releases blog. Because Chrome's renderer process is sandboxed, full code execution typically requires chaining this UAF with a separate sandbox escape, though heap corruption inside the renderer is itself a significant primitive.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.216 or later on all desktop platforms - vendor-released patch per the Chrome Releases Stable channel update at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Most managed environments should rely on Chrome's automatic update mechanism and verify version compliance via chrome://settings/help or enterprise policy reporting, then force a relaunch to apply the update. If immediate patching is not feasible, compensating controls include restricting browsing to trusted sites via enterprise URL allowlists, disabling or restricting screen/tab/window capture and getDisplayMedia permissions via the ScreenCaptureAllowed / ScreenCaptureAllowedByOrigins enterprise policies (trade-off: breaks legitimate screen-sharing in Meet/Zoom web clients), and enabling Site Isolation and the Renderer Code Integrity policy where supported (minimal user-facing impact). Track Chromium-derivative browser advisories (Microsoft Edge, Brave, Opera, Vivaldi) and apply their respin updates as released.