What is the CVSS score of CVE-2026-9965?

CVE-2026-9965 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9965?

A high-severity vulnerability in Google Chrome (versions before 148.0.7778.216) enables arbitrary code execution when users visit malicious websites, affecting all Chrome users in the organization.. A patch is available.

How to fix or mitigate CVE-2026-9965?

Within 24 hours: Alert security and IT teams; inventory Chrome versions across the organization. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all endpoints using standard patch management; confirm deployment completion. Within 30 days: Conduct remediation audit to verify all systems are patched; document and establish monitoring for any systems unable to patch; enforce automatic Chrome updates organization-wide.

Google Chrome CVE-2026-9965

EUVD-2026-33107 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-f6h3-cpvj-2xp3

Google Memory Corruption Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 19:24 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds write in the ANGLE graphics translation layer of Google Chrome before 148.0.7778.216 allows a remote attacker to trigger heap corruption by luring a user to a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates the severity as High and CVSS scores it 8.8, but EPSS exploitation probability is currently very low (0.03%, 11th percentile) and no public exploit identified at time of analysis. The flaw was reported through Chrome's internal disclosure process and a fixed build is already available from the vendor.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chromium uses to translate OpenGL ES API calls from WebGL and similar web graphics features into native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome desktop builds prior to 148.0.7778.216 are in scope. The underlying weakness is CWE-787 (Out-of-bounds Write), a memory-safety class in which a write operation crosses the bounds of an allocated buffer; in graphics translation code this typically arises from miscalculated buffer sizes when handling attacker-controlled shader inputs, vertex data, or texture parameters, and corrupting adjacent heap structures can be steered toward control-flow hijack or sandboxed code execution inside the renderer.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update all desktop Chrome installations to this Stable channel build (or later) as documented in the Chrome Releases advisory https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and verify rollout via chrome://settings/help. For managed fleets, push the update through Group Policy, Jamf/Intune, or your endpoint management platform and force a browser restart, since Chrome only loads the new binary after relaunch. Until the patched build is deployed, compensating controls include disabling hardware-accelerated graphics via the policy 'HardwareAccelerationModeEnabled=false' (which reduces the ANGLE attack surface but degrades video and WebGL performance) or blocking WebGL via 'DefaultWebGLSetting=2' (which breaks legitimate 3D web apps such as Google Maps 3D, Figma, and many dashboards). Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be updated as soon as their vendors ship a build that incorporates the upstream ANGLE fix.