What is the CVSS score of CVE-2026-9998?

CVE-2026-9998 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9998?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability in the Skia graphics library that could allow attackers to break out of browser isolation controls and access…. A patch is available.

How to fix or mitigate CVE-2026-9998?

24 hours: Identify and inventory all systems running Google Chrome versions prior to 148.0.7778.216; prioritize patching for internet-facing devices. 7 days: Complete mandatory deployment of Google Chrome version 148.0.7778.216 or later across all enterprise systems via group policy, MDM, or organizational patch management. 30 days: Verify 100% patch compliance, audit browser telemetry and user endpoint logs for indicators of prior sandbox escapes or suspicious child processes.

Google Chrome CVE-2026-9998

EUVD-2026-33140 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-457m-jpvx-pqx9

Buffer Overflow Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:44 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 enables remote attackers who have already compromised the renderer process to break out of the browser sandbox via an integer overflow in the Skia graphics library. Exploitation requires a crafted HTML page and user interaction, and while a patch is available from Google, there is no public exploit identified at time of analysis and EPSS scoring (0.03%) indicates low near-term exploitation probability.

Technical ContextAI

Skia is the open-source 2D graphics library Chromium uses for rendering shapes, text, and images across the browser UI and web content. The flaw is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), though the description and 'Buffer Overflow' tag point to an integer overflow condition in Skia's rendering logic that can be coerced into corrupting memory. Because Skia runs in privileged GPU/browser-process contexts that the sandboxed renderer communicates with, an integer overflow there becomes a stepping stone for breaking Chrome's process isolation model. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across versions before 148.0.7778.216.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade all desktop Chrome installs to this version or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and validated against the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9998. Enterprise fleets should force-relaunch Chrome after update rollout since the fix only takes effect after restart, and admins managing Chromium-based browsers should confirm that downstream vendors have shipped a Skia update covering the same defect. As a temporary compensating control until patching, restrict navigation to untrusted sites via enterprise URL allowlists (Chrome policy URLBlocklist/URLAllowlist) - this reduces exposure to attacker-controlled HTML but does not stop malvertising or compromised first-party sites, so it is a stopgap only and not a substitute for the upgrade.