What is the CVSS score of CVE-2026-9964?

CVE-2026-9964 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9964?

Google Chrome on macOS versions prior to 148.0.7778.216 contains a use-after-free vulnerability in the Bluetooth component enabling arbitrary code execution through malicious browser extensions.. A patch is available.

How to fix or mitigate CVE-2026-9964?

Within 24 hours: inventory Chrome versions across macOS endpoints; communicate patch advisory to end users. Within 7 days: deploy Chrome 148.0.7778.216 or later to test environments and critical systems (administrative, finance, research). Within 30 days: complete organization-wide rollout via standard mobile device management or browser update policies.

Google Chrome CVE-2026-9964

EUVD-2026-33106 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-3prp-9628-vjqf

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:22 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

8.1 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.1

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution in Google Chrome on macOS prior to 148.0.7778.216 stems from a use-after-free condition in the Bluetooth component, exploitable through a malicious browser extension. Chromium rates the severity as High, and while CVSS scores it 8.1 with network attack vector, real-world exploitation requires the victim to install an attacker-controlled extension. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's Bluetooth subsystem, which implements the Web Bluetooth API allowing web content and extensions to interact with nearby BLE devices through Chromium's browser process. Use-after-free bugs occur when memory is referenced after being freed, typically due to mismatched object lifetimes between renderer/browser processes or callbacks holding stale pointers; in Chrome these are a long-standing source of sandbox escapes and renderer RCE. The affected CPE is cpe:2.3:a:google:chrome with macOS as the platform-specific impact surface, suggesting the bug lives in Mac-specific Bluetooth IPC or CoreBluetooth bridging code.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for macOS - upgrade immediately via Chrome's auto-updater or push the build through MDM (Jamf, Intune, Kandji) per the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Until the update is deployed, enforce ExtensionInstallBlocklist=* with a curated ExtensionInstallAllowlist via Chrome enterprise policy to block ad-hoc extension installs (trade-off: breaks user self-service for legitimate extensions), and consider disabling the Web Bluetooth API by setting DefaultWebBluetoothGuardSetting=2 on managed Macs (trade-off: breaks any internal tools that rely on Web Bluetooth). Bug tracker reference: https://issues.chromium.org/issues/505190999.