What is the CVSS score of CVE-2026-9995?

CVE-2026-9995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-9995?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the WebXR component that enables attackers to compromise employee endpoints when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-9995?

Within 24 hours: Inventory Chrome deployments; communicate vulnerability and patch availability to all users; create rollout plan prioritizing business-critical roles. Within 7 days: Deploy Chrome 148.0.7778.216 or later enterprise-wide via MDM or software distribution tools; monitor rollout progress. Within 30 days: Verify 100% patching completion through endpoint management systems; audit compliance and close out remediation tracking.

Google Chrome CVE-2026-9995

EUVD-2026-33137 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-x7fm-cx6h-8jqr

Use After Free RCE Memory Corruption Google Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:34 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free flaw in the WebXR component, allowing a remote attacker to run arbitrary code within the browser's renderer sandbox by enticing a victim to visit a crafted HTML page. Google rates the underlying Chromium severity as High, and a vendor patch has been released; no public exploit identified at time of analysis.

Technical ContextAI

WebXR is the W3C-standardized Chromium subsystem that exposes virtual and augmented reality device APIs (Device API, Gamepad input, immersive sessions) to JavaScript running in the page, implemented in Blink with IPC bridges to GPU and device services. CWE-416 (Use After Free) indicates that the WebXR implementation continues to dereference a heap object after it has been freed - typically the result of mismatched object lifetimes across asynchronous session callbacks, garbage-collected JS wrappers, or device disconnect events - which can be groomed into a type-confused or attacker-controlled allocation usable to hijack control flow. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop builds before 148.0.7778.216 across platforms that ship the WebXR feature.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade all desktop Chrome installations to this version or later, per the Stable Channel update at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and force-restart the browser so the new binary loads (Chrome's silent updater stages the fix but a session restart is required to activate it). For managed fleets, push the update via Chrome Browser Cloud Management or platform MDM and verify the running version through chrome://version. Until rollout completes, an effective compensating control is disabling the WebXR Device API by setting the enterprise policy WebXRImmersiveArSupportEnabled to false (or launching with --disable-features=WebXR), which neutralizes the vulnerable code path at the cost of breaking legitimate VR/AR web applications; users of Chromium-derived browsers (Edge, Brave, Opera, Electron apps) should apply vendor updates as soon as they incorporate the upstream Chromium fix.