What is the CVSS score of EUVD-2026-33108?

EUVD-2026-33108 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33108?

Google Chrome on Windows is vulnerable to a sandbox escape (CVE-2026-9966, CVSS 8.3) that allows attackers who have already compromised the browser to gain unauthorized system access.. A patch is available.

How to fix or mitigate EUVD-2026-33108?

Within 24 hours: Alert Windows administrators and initiate deployment plan for Chrome 148.0.7778.216 or later. Within 7 days: Deploy patched Chrome version to all Windows endpoints using standard patch management. Within 30 days: Verify deployment completion via endpoint inventory and confirm Chrome version compliance across the organization.

Google Chrome EUVD-2026-33108

| CVE-2026-9966 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-946c-jrh2-x2cr

Google Microsoft Buffer Overflow Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:41 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers an integer overflow in XML handling. The flaw is rated Chromium High severity with CVSS 8.3 and requires user interaction plus a chained renderer compromise; no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Technical ContextAI

The vulnerability resides in Chrome's XML processing code, classified as CWE-472 (External Control of Assumed-Immutable Web Parameter) and tagged as a Buffer Overflow / integer overflow condition. Chromium's multi-process architecture isolates untrusted web content inside a sandboxed renderer process, while privileged operations are handled by the browser process; XML parsing routines that are reachable from the renderer can cross this trust boundary if malformed input causes arithmetic miscalculations that lead to memory corruption. According to the supplied CPE (cpe:2.3:a:google:chrome:*) and EUVD data, the bug affects the Chrome desktop browser on Windows specifically, and exploitation requires the integer overflow path to be reachable from an already-compromised renderer.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for Windows - update Chrome to this version or later via the Stable channel as described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html); managed environments should push the update through Chrome Browser Cloud Management, Group Policy, or the equivalent MDM channel and verify the version on endpoints. No vendor workaround is documented for this specific issue; as a compensating control until patching completes, restrict browsing of untrusted HTML/XML content (for example by enforcing strict Site Isolation, which is on by default, and considering temporary use of Enhanced Safe Browsing or application allow-listing), keeping in mind that disabling XML-handling features broadly is not exposed as a configurable knob and would break legitimate web functionality. Cross-reference the tracking bug at https://issues.chromium.org/issues/506388321 for any follow-up notes.