What is the CVSS score of CVE-2026-9962?

CVE-2026-9962 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9962?

Google Chrome WebRTC vulnerability (CVE-2026-9962, CVSS 8.8) enables arbitrary code execution within the browser sandbox when users visit crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-9962?

Within 24 hours: Inventory all Chrome deployments across managed and unmanaged endpoints to understand exposure scope. Within 7 days: Deploy Chrome 148.0.7778.216 or later through automated patch management; implement browser update enforcement policies for unmanaged devices. Within 30 days: Audit patch deployment success rates, review browser security logs for exploitation attempts, and conduct user awareness training on avoiding suspicious websites.

Google Chrome CVE-2026-9962

EUVD-2026-33104 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-xf76-hmq4-v7qj

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:32 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's WebRTC component (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code within the browser sandbox by enticing a victim to load a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High by Chromium's security team, and while no public exploit identified at time of analysis, the CVSS 8.8 score reflects the low-complexity network-based attack vector combined with the high impact across confidentiality, integrity, and availability. User interaction (visiting a malicious page) is required, but otherwise no authentication or privileges are needed.

Technical ContextAI

The vulnerability resides in WebRTC, the real-time communication framework embedded in Chromium that handles peer-to-peer audio, video, and data channels through protocols such as SRTP, DTLS, ICE, and SDP. CWE-416 (Use After Free) describes a memory safety class where an object is freed but a dangling pointer continues to reference it; subsequent use of that pointer can yield attacker-controlled memory contents, enabling type confusion, information disclosure, or arbitrary code execution. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates desktop Chrome builds across platforms; because WebRTC processing can be triggered by JavaScript APIs (RTCPeerConnection, getUserMedia signaling) on any web page, the attack surface is broad and reachable directly from a renderer process. Successful exploitation grants code execution inside the renderer's sandbox, which still requires a separate sandbox escape to achieve full system compromise.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 or later on the Stable channel - upgrade immediately via the Chrome auto-update mechanism (chrome://settings/help) or organizational software distribution tooling, and restart the browser to load the patched binary, as referenced in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Administrators managing Chromium-derivative browsers should monitor their respective vendor channels (Edge, Brave, Opera, Vivaldi) for downstream rebases that incorporate the fix. As a temporary compensating control until patches are deployed, restrict WebRTC by enforcing the WebRtcAllowLegacyTLSProtocols=false and WebRtcUdpPortRange enterprise policies, or fully disable WebRTC peer connections through the URLBlocklist / extension-based blockers, accepting the trade-off that video conferencing tools (Google Meet, Teams web client, Jitsi) will break; alternatively route browsing through an isolation/RBI gateway for high-risk users.