What is the CVSS score of EUVD-2026-33112?

EUVD-2026-33112 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33112?

Google Chrome versions prior to 148.0.7778.216 contain a WebGL sandbox escape vulnerability (CVE-2026-9970) that could elevate privileges from a compromised renderer process to full system control.. A patch is available.

How to fix or mitigate EUVD-2026-33112?

24 hours: Catalog Chrome deployments and current version baseline. 7 days: Deploy Chrome 148.0.7778.216 or later to all endpoints; prioritize systems in high-risk roles and public-facing networks. 30 days: Verify patch compliance across the entire fleet and establish automated version monitoring.

Google Chrome EUVD-2026-33112

| CVE-2026-9970 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-qj2q-qxr3-j88c

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:24 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's WebGL component (versions prior to 148.0.7778.216) allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High severity by Chromium, requiring user interaction (visiting a page) and a prior renderer compromise, making it a second-stage exploit primitive. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03%.

Technical ContextAI

The vulnerability resides in WebGL, the JavaScript API in Chromium that exposes GPU-accelerated 2D/3D rendering to web content via the renderer process. The root cause is CWE-416 (Use After Free), where memory referenced by a pointer is freed but the pointer is subsequently dereferenced, allowing an attacker who controls heap layout to redirect execution or corrupt object state. Because WebGL bridges the renderer (sandboxed) and GPU process (more privileged), a UAF here is a classic primitive for chained sandbox-escape exploits. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all desktop platforms running Chrome stable prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Chrome Stable 148.0.7778.216 or later - update immediately via Chrome's auto-update mechanism or by forcing a relaunch (chrome://settings/help) and confirm with the advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, push the updated MSI/PKG/DEB via your endpoint management platform and verify the build with the RelaunchNotification and TargetVersionPrefix policies. If patching must be delayed, compensating controls include disabling WebGL by setting chrome://flags/#disable-webgl or the enterprise policy WebGLEnabled=false (side effect: breaks Google Maps 3D, Figma, many WebGL games and data-visualization sites), and restricting browsing of untrusted content via URL allowlisting; site isolation and the GPU sandbox should already be enabled and left on. Track Chromium-based downstream products (Edge, Brave, Electron apps) separately as they ship the fix on their own cadence.