What is the CVSS score of CVE-2026-9977?

CVE-2026-9977 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9977?

Google Chrome on Android prior to version 148.0.7778.216 contains a sandbox escape vulnerability (CVE-2026-9977) that could allow attackers who compromise the renderer process to escalate attacks to…. A patch is available.

How to fix or mitigate CVE-2026-9977?

24 hours: Identify Chrome versions across Android devices in your organization and BYOD inventory; prioritize devices still running versions prior to 148.0.7778.216. | 7 days: Deploy Chrome version 148.0.7778.216 or later to all Android devices; test on representative devices for compatibility. | 30 days: Confirm 95%+ of Chrome on Android devices have received the patch and document remediation status for audit purposes.

Google Chrome CVE-2026-9977

EUVD-2026-33119 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-7x5x-m385-pfxv

Google Information Disclosure Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:43 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page abusing the WebShare component. Chromium rates the issue High severity, and CVSS scores it 8.3 reflecting the scope-change impact, though EPSS is currently low at 0.04% and no public exploit is identified at time of analysis.

Technical ContextAI

The flaw resides in the WebShare implementation of Chrome's Android port, which exposes the navigator.share() Web API to bridge web content with the underlying Android Sharesheet system. WebShare straddles the renderer/browser boundary because it must pass user-provided content (URLs, text, files) from the sandboxed renderer to privileged browser-process code that talks to Android Intents. The underlying weakness is CWE-20 (Improper Input Validation): trusted browser-process code accepted data from the lower-privileged renderer without sufficient sanity-checking, enabling an attacker who already controls the renderer to influence privileged operations. The CPE entry (cpe:2.3:a:google:chrome) is generic, but the description narrows impact specifically to the Android build.

RemediationAI

Vendor-released patch: Chrome for Android 148.0.7778.216 - upgrade affected installations to this version or later via the Google Play Store as referenced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). For managed Android fleets, push the update through MDM and verify the installed build version on devices. No formal workaround is published, but as a compensating control administrators can disable the Web Share API via enterprise policy (DefaultWebShareSetting / per-origin controls) where supported - note this will break legitimate share-sheet functionality in web apps that rely on navigator.share(). Restricting users to vetted sites via SafeBrowsing Enhanced Protection and blocking unknown app installs reduces the likelihood of the prerequisite renderer compromise that this bug chains from.