What is the CVSS score of EUVD-2026-33093?

EUVD-2026-33093 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33093?

Google Chrome prior to version 148.0.7778.216 contains a sandbox escape vulnerability (CVSS 8.3) that could enable remote code execution through malicious websites.. A patch is available.

How to fix or mitigate EUVD-2026-33093?

Within 24 hours: Alert security leadership and IT operations; inventory current Chrome versions across all systems. Within 7 days: Deploy Chrome 148.0.7778.216 or later organization-wide using endpoint management tools; target 100% of systems. Within 30 days: Audit patch compliance and remediate any remaining unpatched instances.

Google Chrome EUVD-2026-33093

| CVE-2026-9951 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-7fh4-6w4j-8rg7

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:24 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in UI in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 enables remote attackers to break out of the renderer process sandbox by enticing a user to visit a crafted HTML page that triggers a use-after-free condition in the UI component. Chromium rates the severity as High, and a vendor patch is available; no public exploit identified at time of analysis and EPSS exploitation probability is currently very low (0.03%, 11th percentile).

Technical ContextAI

The flaw resides in Chrome's UI subsystem and is classified as CWE-416 (Use After Free), a memory-corruption class where a freed heap object is accessed again - typically yielding a dangling pointer that can be reclaimed and reused to influence control flow or data structures. Because the bug sits in the browser-process UI layer rather than purely in the renderer, successful triggering crosses the renderer/browser trust boundary, which is the mechanism enabling the sandbox escape impact reflected in the CVSS scope-change (S:C). The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering Chrome desktop builds before the fixed milestone.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 or later - update Chrome on all desktop endpoints via the Stable channel auto-update or by pushing the latest MSI/PKG/DEB through your endpoint management tool, then restart the browser to apply (Chrome will not load the patched binaries until relaunch). The vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html is the authoritative reference, with the upstream bug tracked at https://issues.chromium.org/issues/503873388. If immediate patching is not possible, compensating controls include restricting browsing to trusted sites via enterprise policy or web-proxy URL allowlisting (trade-off: breaks general web access), enforcing Site Isolation and ensuring sandboxing is not disabled (low impact, default behavior to verify), and using Chrome's Enterprise policies to disable risky web platform features for high-risk user groups - none of these substitute for the patch since the bug lives in the UI component reachable by ordinary web content.