What is the CVSS score of CVE-2026-9993?

CVE-2026-9993 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9993?

Google Chrome versions before 148.0.7778.216 contain a sandbox escape vulnerability that allows attackers who have already compromised the browser to gain full system access.. A patch is available.

How to fix or mitigate CVE-2026-9993?

Within 24 hours: Identify all systems running Chrome versions prior to 148.0.7778.216 through your asset inventory or endpoint management system. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all endpoints using your standard software distribution process, targeting 100% coverage. Within 30 days: Verify patch deployment completion across all systems and implement automatic Chrome update policies to ensure continuous patch coverage.

Google Chrome CVE-2026-9993

EUVD-2026-33135 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-c6qp-9pp3-r26q

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:25 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox by serving a crafted PDF file that triggers a use-after-free in the Views component. Chromium rates the severity as High and Google has shipped a fixed Stable channel build, but no public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile). The bug is a second-stage primitive - it requires an existing renderer compromise plus user interaction with a malicious PDF, which is the typical shape of a Chrome exploit chain.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromium's Views UI framework, the cross-platform widget toolkit used to render browser chrome and embedded surfaces such as the PDF viewer. Use-after-free arises when a heap object is freed while another pointer still references it; subsequent dereference can be steered into attacker-controlled memory to achieve arbitrary read/write and ultimately code execution in the host (browser) process. Because Views runs in the privileged browser process rather than the sandboxed renderer, corrupting it from a compromised renderer is a classic sandbox-escape primitive in Chromium's multi-process security model, and the crafted PDF acts as the trigger via the integrated PDFium/Views interaction path. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 148.0.7778.216 or later on all desktop platforms via the Stable channel update described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html; in managed environments verify Chrome auto-update is enabled or push the build through your software management system. Restart the browser after update to ensure the patched binary is active, since Chrome continues running the old version until relaunch. For Chromium-derived browsers, wait for and apply the vendor's rebased build referencing this fix. If patching must be delayed, compensating controls include disabling Chrome's built-in PDF viewer (chrome://settings 'Download PDFs' or the AlwaysOpenPdfExternally enterprise policy) so PDFs are handed off to an external reader - trade-off is loss of in-browser PDF UX and shifting risk to whichever external reader is used - and tightening site isolation / restricting untrusted content via enterprise policy; tracking issue https://issues.chromium.org/issues/513208588 has further detail when access is granted.