What is the CVSS score of CVE-2026-9982?

CVE-2026-9982 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9982?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability enabling privilege escalation after browser renderer compromise.. A patch is available.

How to fix or mitigate CVE-2026-9982?

Within 24 hours: Audit Chrome deployment inventory and identify version distribution across endpoints. Within 7 days: Distribute Chrome 148.0.7778.216 or later through standard patch management; prioritize users in high-risk roles (engineering, finance, executive). Within 30 days: Verify 100% deployment completion and confirm rollback mechanisms are disabled to prevent version regression.

Google Chrome CVE-2026-9982

EUVD-2026-33124 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-cmw4-89hp-6854

Google Information Disclosure Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:43 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE component prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw stems from insufficient validation of untrusted input (CWE-20) in ANGLE, Chrome's translation layer for graphics APIs. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%, 15th percentile), but the Chromium-assigned 'High' severity reflects its value as the second stage in a browser exploit chain.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chrome uses to translate OpenGL ES calls from WebGL and other web graphics APIs into the native graphics API of the host platform (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE processes attacker-controlled GPU commands originating from web content, it sits at a privileged boundary between the sandboxed renderer and the more-privileged GPU process. CWE-20 (Improper Input Validation) here means ANGLE failed to fully validate data crossing this IPC boundary, allowing a malicious renderer to deliver crafted input that triggers unintended behavior in a higher-privilege context. The CPE cpe:2.3:a:google:chrome confirms the desktop Chrome browser as the affected product across all platforms ANGLE supports.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update via the built-in updater or by relaunching Chrome and confirming the version under chrome://settings/help, per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise administrators should push the updated MSI/PKG through their software management tooling and verify that Chromium-derived browsers (Edge, Brave, Opera, Electron apps) have absorbed the equivalent ANGLE fix before considering them patched. If immediate patching is not possible, compensating controls include disabling hardware-accelerated graphics via the --disable-gpu flag or the chrome://flags 'Override software rendering list' toggle (trade-off: degraded WebGL/Canvas performance and broken WebGPU features), or deploying site isolation policies to limit which origins can reach the GPU process. Blocking WebGL via enterprise policy (DefaultWebGLBlockedForUrls) is a narrower control but breaks many modern web applications.