What is the CVSS score of CVE-2026-9976?

CVE-2026-9976 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9976?

Google Chrome contains a critical remote code execution vulnerability (CVE-2026-9976) that allows unauthenticated attackers to compromise systems through crafted webpages; no public exploit has been…. A patch is available.

How to fix or mitigate CVE-2026-9976?

Within 24 hours: Issue urgent security advisory to all users and system administrators regarding CVE-2026-9976 and the requirement to update Chrome. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all organizational devices via automated update mechanisms or mobile device management (MDM). Within 30 days: Conduct comprehensive audit to confirm patch deployment across 100% of Chrome installations and validate no systems remain on vulnerable versions.

Google Chrome CVE-2026-9976

EUVD-2026-33118 HIGH

Code Injection (CWE-94)

2026-05-28 Chrome

GHSA-fj5j-5vm7-q87m

RCE Google Code Injection

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:22 vuln.today

CVSS changed

May 29, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 allows attackers to run arbitrary code by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the browser's USB subsystem. Chromium rates the severity as High and the CVSS 8.8 vector reflects unauthenticated network exploitation with required user interaction. No public exploit identified at time of analysis, but the vendor has shipped a stable channel patch.

Technical ContextAI

The flaw resides in Chrome's USB implementation, which exposes WebUSB and related device-interaction surfaces to web content through the Chromium browser process and renderer sandbox. CWE-94 (Improper Control of Generation of Code, i.e., Code Injection) indicates that attacker-controlled input can influence code paths in a way that leads to arbitrary code execution, most likely by inducing the USB handling logic to operate on data it should not trust. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome installations across desktop platforms, where the USB stack is shared across Windows, macOS, and Linux builds of the Chromium engine.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216; update all desktop Chrome installations to this version or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and verify rollout through enterprise management (Google Update, MDM, or Chrome Browser Cloud Management). Until devices are patched, consider disabling WebUSB through the enterprise policy DefaultWebUsbGuardSetting=2 (block) or WebUsbBlockedForUrls covering all sites, which removes the affected attack surface at the cost of breaking legitimate WebUSB applications such as hardware security keys configurators and developer tools. Restrict user browsing to trusted destinations via web filtering and enforce site isolation and the sandbox; these reduce but do not eliminate exposure to crafted HTML pages targeting this flaw.