What is the CVSS score of CVE-2026-9968?

CVE-2026-9968 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9968?

Google Chrome's V8 JavaScript engine contains a remote code execution vulnerability (CVE-2026-9968, CVSS 8.8) triggered when users visit a specially crafted webpage.. A patch is available.

How to fix or mitigate CVE-2026-9968?

Within 24 hours: Inventory all Chrome instances in your environment and document current version levels. Within 7 days: Deploy Chrome version 148.0.7778.216 or later enterprise-wide, prioritizing high-value user endpoints and systems receiving untrusted content. Within 30 days: Verify patch deployment across 100% of Chrome installations through automated compliance scanning.

Google Chrome CVE-2026-9968

EUVD-2026-33110 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-h27q-8vvw-gwhp

RCE Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:32 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 148.0.7778.216 allows attackers to run arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw stems from an integer overflow (CWE-472, External Control of Assumed-Immutable Web Parameter / integer-handling weakness in V8) rated High severity by Chromium and CVSS 8.8. No public exploit identified at time of analysis, and the bug is not currently listed in CISA KEV.

Technical ContextAI

V8 is Google's open-source JavaScript and WebAssembly engine that powers Chrome, Edge, Opera, Brave, and all Chromium-derived browsers, as well as Node.js. Integer overflow vulnerabilities in V8 typically arise in JIT-compiled code paths, typed array handling, or bounds-check elimination, where an attacker-controlled numeric value wraps around and causes the engine to mis-size a buffer or skip a safety check. The resulting type confusion or out-of-bounds access can be leveraged to corrupt V8's heap and ultimately gain arbitrary read/write within the renderer process. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) confirms the affected component is the Chrome browser itself; downstream Chromium consumers are likely affected pending their own backports.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (Stable channel) - upgrade immediately via Chrome's built-in updater or by reinstalling from https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise administrators should push the new build via Google Update / Chrome Browser Cloud Management and verify deployment with the chrome://version page or inventory tooling. Users of other Chromium-based browsers should monitor their respective vendors (Edge, Brave, Opera, Electron) for backported releases and update as soon as those are available. As an interim compensating control where patching is delayed, disable the V8 JIT compiler by launching Chrome with --js-flags="--jitless" or via the JavaScriptJitDisabledForSites enterprise policy - this removes most JIT-related exploitation primitives at a measurable JavaScript performance cost; alternatively, restrict browsing to a curated allowlist or route untrusted browsing through a remote browser isolation service until the patch is deployed. Tracking issue: https://issues.chromium.org/issues/506499280.