What is the CVSS score of CVE-2026-9988?

CVE-2026-9988 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9988?

Google Chrome on Linux contains a high-severity sandbox escape vulnerability (CVE-2026-9988) in versions prior to 148.0.7778.216 that could allow remote code execution outside the browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-9988?

Within 24 hours: Inventory Chrome deployments on Linux systems (desktop and servers). Within 7 days: Deploy Chrome 148.0.7778.216 or later to all affected Linux endpoints. Within 30 days: Verify 100% patch compliance, document deployment, and implement automated Chrome update enforcement to prevent future similar delays.

Google Chrome CVE-2026-9988

EUVD-2026-33130 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-855j-754p-55fw

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:44 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux prior to 148.0.7778.216 allows remote attackers to leverage a WebRTC use-after-free condition through a crafted HTML page to break out of the renderer sandbox. The flaw was reported by the Chrome security team and rated High severity by Chromium, with no public exploit identified at time of analysis and an EPSS score of 0.03% (10th percentile) suggesting low near-term exploitation likelihood. Successful exploitation requires user interaction (visiting a malicious page) and high attack complexity, but the scope-changing impact (S:C) and full CIA compromise make it a meaningful browser-targeted risk.

Technical ContextAI

The vulnerability resides in WebRTC, the real-time communication framework embedded in Chromium that handles peer-to-peer audio, video, and data channels through components like libwebrtc and the Chromium media/networking stack. The root cause is CWE-416 (Use After Free), where memory is referenced after it has been released - a hallmark memory-safety flaw in C++ codebases like Chromium that typically arises from object lifetime mismanagement across WebRTC's asynchronous callbacks and threading model. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and Linux-specific scope in the description indicate the Linux build of the Chrome browser is the affected target, with the sandbox-escape characterization implying the UAF is reachable from the renderer process and can be chained to break Chromium's Linux seccomp-bpf/namespace-based sandbox boundary.

RemediationAI

Upgrade Google Chrome on Linux to version 148.0.7778.216 or later, which is the vendor-released patch per Google's Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html); enterprise environments should push the update via their package manager, configuration management, or Chrome Enterprise auto-update channels and verify rollout with the version check at chrome://settings/help. If patching must be delayed, compensating controls include disabling WebRTC where feasible by setting the WebRtcUdpPortRange or WebRtcAllowLegacyTLSProtocols policies to constrain the attack surface and using enterprise policy URLBlocklist to block untrusted sites - note that disabling WebRTC entirely breaks Google Meet, Zoom web client, and other RTC-dependent applications, so this is a significant usability trade-off. Chromium-based downstream browsers (Edge, Brave, Opera, Vivaldi) on Linux should also be checked once their respective vendors ship the merged fix; track upstream details via https://issues.chromium.org/issues/513049286.