What is the CVSS score of CVE-2026-9994?

CVE-2026-9994 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9994?

Google Chrome on Windows versions prior to 148.0.7778.216 contain a sandbox escape vulnerability (CVE-2026-9994) that allows attackers to break out of the browser's security sandbox after…. A patch is available.

How to fix or mitigate CVE-2026-9994?

Within 24 hours: Audit current Chrome versions across Windows systems and identify non-compliant installations. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all Windows endpoints; prioritize systems handling untrusted web content. Within 30 days: Confirm 100% patching completion and document exceptions via endpoint inventory scans.

Google Chrome CVE-2026-9994

EUVD-2026-33136 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-g98w-p3r8-874w

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:26 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the Core component. Google rates this Chromium severity as High, and a vendor patch is available; no public exploit identified at time of analysis, and EPSS is very low (0.03%, 11th percentile). Exploitation requires a chained renderer compromise plus user interaction, so it is a meaningful second-stage primitive rather than a one-shot drive-by RCE.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromium's Core module, which on Windows underpins rendering, lifecycle management, and IPC plumbing between the sandboxed renderer process and the broker/browser process. Use-after-free conditions arise when an object is freed while a dangling pointer is later dereferenced, letting an attacker who controls heap layout reuse the slot with attacker-controlled data and hijack a virtual call or callback. Because the vulnerable code path is reachable from a compromised renderer, the bug is positioned as a sandbox-escape primitive - exactly the class of issue Chrome's multi-process architecture is designed to contain. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, combined with the description, scopes the issue to the Windows desktop Chrome build prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 on the Windows Stable channel, distributed via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html - update Chrome to 148.0.7778.216 or later and force-restart browsers to apply, and enterprise admins should verify rollout via the Chrome Enterprise update policy and the issues.chromium.org/issues/513235131 tracker. If immediate patching is not possible, reduce risk by enforcing Site Isolation (already default) and Enhanced Safe Browsing to limit malicious page exposure, blocking known malicious domains at the proxy, and disabling third-party renderer-reachable features that increase renderer attack surface such as legacy plugins and unnecessary extensions - accepting the trade-off of reduced functionality for embedded content. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be tracked for their corresponding downstream releases since they share the Core code path.