What is the CVSS score of CVE-2026-9967?

CVE-2026-9967 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9967?

A critical sandbox escape in Google Chrome prior to version 148.0.7778.216 enables attackers to compromise employee workstations and access organizational systems through malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-9967?

Within 24 hours: Identify all Chrome deployments across managed endpoints and issue a user advisory recommending caution with untrusted websites; begin testing Google Chrome 148.0.7778.216 patches on pilot systems. Within 7 days: Deploy Google Chrome 148.0.7778.216 or later to all production endpoints via your standard patch management process; verify completion and confirm updated versions across the fleet. Within 30 days: Review endpoint telemetry and security logs for any exploitation attempts prior to patching; document remediation completion and validate patch compliance across all assets.

Google Chrome CVE-2026-9967

EUVD-2026-33109 CRITICAL

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-39vg-p77q-35gx

Google Memory Corruption Buffer Overflow Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:42 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker to trigger an out-of-bounds write in the GPU process via a crafted HTML page, potentially breaking out of Chrome's renderer sandbox. The flaw carries a CVSS 9.6 due to scope change (S:C) and high impact across confidentiality, integrity, and availability, but requires user interaction (UI:R) such as visiting a malicious page. No public exploit identified at time of analysis, and EPSS is very low at 0.03% (11th percentile), suggesting limited near-term mass exploitation despite the severe potential impact.

Technical ContextAI

The vulnerability is rooted in CWE-787 (Out-of-bounds Write) within Chrome's GPU process, which handles accelerated graphics rendering (typically via ANGLE, Skia, and Dawn/WebGPU pipelines). Chrome's multi-process architecture isolates the renderer in a sandbox, but the GPU process runs with broader privileges to interface with system graphics drivers; a memory corruption bug in this process can be chained with a renderer compromise to escape the sandbox and reach the host. The affected CPE (cpe:2.3:a:google:chrome:*) covers the desktop Chrome browser, and the flaw was internally reported by the Chrome team and rated High severity by Chromium.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 - update Chrome via the Stable channel as described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and verify via chrome://settings/help, then restart the browser to apply. For managed fleets, push the update through enterprise management (Chrome Browser Cloud Management, group policy, or MDM) and confirm version compliance. As a temporary workaround until patching, GPU-process exposure can be reduced by launching Chrome with --disable-gpu or disabling hardware acceleration in Settings > System, accepting the trade-offs of degraded rendering performance, broken WebGL/WebGPU workloads, and higher CPU usage; for chromium-based derivatives, monitor the respective vendor advisories and apply their corresponding releases once available.