What is the CVSS score of CVE-2026-9969?

CVE-2026-9969 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9969?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the ANGLE graphics layer allowing attackers to execute arbitrary code on user machines through…. A patch is available.

How to fix or mitigate CVE-2026-9969?

Within 24 hours: Determine Chrome deployment scope and current version distribution across endpoints. Within 7 days: Deploy Google Chrome 148.0.7778.216 or later organization-wide using established patch management; prioritize users with high-sensitivity roles and internet-facing access. Within 30 days: Validate 100% patched status via endpoint scanning and generate compliance report.

Google Chrome CVE-2026-9969

EUVD-2026-33111 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-c58w-v557-6m52

Google RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:30 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows attackers to run arbitrary code on a victim's machine when they visit a malicious web page. The flaw stems from insufficient validation of untrusted input (CWE-20) within ANGLE and carries a CVSS 8.8 rating reflecting network reach with user interaction. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.05% (16th percentile), but the high technical impact and Chrome's massive install base warrant prompt patching.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and OpenGL ES calls onto the host platform's native graphics APIs such as Direct3D, Metal, or Vulkan. Because ANGLE parses GPU shader programs and command streams supplied by web content, it has historically been a high-value attack surface; the CWE-20 (Improper Input Validation) root cause indicates that crafted graphics input is processed without sufficient sanity checks, enabling memory corruption that leads to code execution. CPE data (cpe:2.3:a:google:chrome:*) confirms the issue affects Google Chrome itself, and downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) typically inherit ANGLE flaws until they roll up the upstream fix.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Stable Channel desktop installations to this version or later via the official update mechanism, with reference to the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the upstream tracker at https://issues.chromium.org/issues/506550494. Enterprises managing Chrome via group policy should force-restart browsers after the update rolls out, since the fix only takes effect once the browser process is relaunched, and should audit Chromium-based derivatives (Edge, Brave, Opera) for their corresponding rebased builds. If patching is delayed, a partial compensating control is to disable hardware-accelerated WebGL via the chrome://flags 'Override software rendering list' setting or the HardwareAccelerationModeEnabled enterprise policy, which reduces ANGLE attack surface at the cost of degraded performance for graphics-heavy web apps; site-isolation and strict third-party content blocking via enterprise policy further reduce the chance of a drive-by hit.