What is the CVSS score of CVE-2026-9992?

CVE-2026-9992 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9992?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the Network component that allows attackers to execute arbitrary code on visited devices through…. A patch is available.

How to fix or mitigate CVE-2026-9992?

24 hours: Conduct inventory of Chrome deployments across all managed endpoints and establish patch readiness. 7 days: Deploy Chrome version 148.0.7778.216 or later organization-wide via patch management tools, prioritizing user-facing workstations; block older versions from running if technically feasible. 30 days: Audit and verify 100% deployment compliance; implement forced automatic updates to prevent regression to vulnerable versions.

Google Chrome CVE-2026-9992

EUVD-2026-33134 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-v4c4-q9w7-m653

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:33 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Network component prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by the Chromium team, and while no public exploit is identified at time of analysis, browser memory-corruption bugs of this class are historically attractive targets when chained with a sandbox escape.

Technical ContextAI

The vulnerability resides in the Network component of Chromium, the open-source browser engine that underpins Google Chrome and many derivative browsers (Edge, Brave, Opera, Vivaldi). CWE-416 (Use After Free) occurs when memory is referenced after it has been freed, typically because a pointer is retained past the object's lifetime; an attacker who can control allocations in the freed slot can corrupt object metadata and pivot to arbitrary read/write or code execution. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering Chrome desktop versions prior to 148.0.7778.216, and the issue is tracked internally in Chromium as issue 513177826 with the fix delivered via the Stable channel desktop update.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 or later on the Stable desktop channel - install via Chrome's built-in updater (chrome://settings/help) or by deploying the updated MSI/PKG via enterprise management tools. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium tracker at https://issues.chromium.org/issues/513177826 for additional context. If immediate patching is not possible, compensating controls include enabling Site Isolation (already default in Chrome) to limit cross-origin memory access, deploying the Chrome Enterprise policy SitePerProcess=true to enforce process-per-site, and using URL filtering or DNS-layer blocking to prevent users from reaching untrusted HTML content; note that disabling JavaScript via policy would substantially reduce risk but break most modern web applications, making it a poor trade-off outside high-security environments.