What is the CVSS score of CVE-2026-9997?

CVE-2026-9997 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9997?

Google Chrome versions before 148.0.7778.216 contain a sandbox escape vulnerability that could allow attackers to break out of the browser sandbox on compromised systems, potentially leading to…. A patch is available.

How to fix or mitigate CVE-2026-9997?

24 hours: Issue mandatory notification for Chrome update and verify update infrastructure is operational. 7 days: Deploy Google Chrome 148.0.7778.216 or later to all systems through endpoint management; confirm deployment via inventory audit. 30 days: Implement automated Chrome updates to prevent version lag and perform final compliance verification across the enterprise.

Google Chrome CVE-2026-9997

EUVD-2026-33139 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-2x67-3hqq-gfwq

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:26 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the Input component. Chromium rates the severity as High and CVSS scores it 8.3, but EPSS estimates exploitation probability at only 0.03% (11th percentile) and no public exploit identified at time of analysis. The flaw is a chained-exploitation primitive rather than a standalone RCE, requiring an attacker to first achieve renderer code execution before leveraging this bug.

Technical ContextAI

The vulnerability is a CWE-416 (Use After Free) memory corruption issue in the Input subsystem of Chromium's browser process, which handles input event routing across renderer/browser process boundaries. The affected codebase is the Chromium engine used by Google Chrome (cpe:2.3:a:google:chrome), and likely propagates to downstream browsers (Edge, Brave, Opera, Vivaldi) once they pull the upstream fix. Use-after-free flaws occur when memory is freed but a dangling pointer is later dereferenced; in a browser context they can yield read/write primitives that, combined with type confusion, allow attackers to corrupt sensitive browser-process objects and escape the renderer sandbox.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (Stable channel) - upgrade immediately via Chrome's built-in updater and restart the browser to apply, as detailed in the Chrome Releases advisory https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, push the update via Group Policy, Jamf, or your MDM and verify version >= 148.0.7778.216 across endpoints. Administrators of Chromium-derived browsers (Edge, Brave, Opera) should track their respective vendor advisories and apply downstream updates once available. Because this bug requires a prior renderer compromise to exploit, complementary mitigations include enabling Site Isolation (default on desktop), enforcing Enhanced Safe Browsing, and restricting installation of untrusted extensions; these reduce the likelihood of the prerequisite renderer compromise but do not address the underlying use-after-free.