What is the CVSS score of CVE-2026-9974?

CVE-2026-9974 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9974?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability (CVSS 8.3) that allows attackers who have compromised the renderer process to execute arbitrary code with…. A patch is available.

How to fix or mitigate CVE-2026-9974?

Within 24 hours: Inventory Chrome deployments and identify systems where auto-update is disabled or managed centrally. Within 7 days: Deploy Chrome 148.0.7778.216 or later via your patch management system; enforce auto-update settings where organizational policy permits. Within 30 days: Verify patching completion across all systems, flag any pre-148.0.7778.216 instances for remediation, and enable enhanced browser security event logging to detect exploitation attempts.

Google Chrome CVE-2026-9974

EUVD-2026-33116 HIGH

Out-of-bounds Write (CWE-787)

2026-05-28 Chrome

GHSA-cjp7-qfwc-w9jj

Google Memory Corruption Buffer Overflow Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:42 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's GPU process prior to version 148.0.7778.216 allows remote attackers who have already compromised the renderer process to break out of the Chromium sandbox via a crafted HTML page. The flaw is an out-of-bounds write (CWE-787) rated High by Chromium with CVSS 8.3, and while a vendor patch is available, no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Technical ContextAI

The vulnerability resides in Chrome's GPU process, a privileged component that handles graphics command buffers and shares memory with sandboxed renderer processes via Mojo IPC. CWE-787 (Out-of-bounds Write) typically arises when GPU command parsing, shared-memory buffer validation, or texture/buffer allocation fails to bound-check attacker-influenced indices or sizes, allowing memory corruption in a higher-privileged process. Because the GPU process runs outside the renderer's tight sandbox, corrupting it provides a path out of Chromium's site-isolation boundary. The CPE confirms the affected product is google:chrome across all platforms shipping the vulnerable Chromium build.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update desktop Chrome to this version or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and force-restart browsers to apply staged updates in managed fleets. Downstream Chromium-based browsers should be updated as soon as their vendor ships an equivalent build. If patching must be delayed, partial mitigation is possible by disabling GPU acceleration via the --disable-gpu flag or the chrome://settings 'Use hardware acceleration' toggle to reduce GPU-process attack surface, accepting the trade-off of degraded rendering performance and broken WebGL/WebGPU content; enterprise policies can also enforce site isolation and block untrusted sites via SafeBrowsing/URL allowlists to make renderer compromise harder, which is the required first stage of this chain.