What is the CVSS score of EUVD-2026-33117?

EUVD-2026-33117 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33117?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability that allows previously compromised browser processes to escalate to system-level code execution.. A patch is available.

How to fix or mitigate EUVD-2026-33117?

Within 24 hours: Inventory Chrome versions across the organization using endpoint management tools and identify all systems running versions prior to 148.0.7778.216. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all critical systems, servers, and administrative workstations. Within 30 days: Complete rollout to remaining systems and enforce automatic updates for Chrome across managed devices.

Google Chrome EUVD-2026-33117

| CVE-2026-9975 HIGH

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-rpm7-phh8-26f7

Google Buffer Overflow Information Disclosure Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:43 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds read and write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 is possible through an out-of-bounds read and write vulnerability in the ANGLE graphics translation layer. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of Chrome's sandbox and potentially execute code at a higher privilege level. No public exploit identified at time of analysis, and EPSS is very low at 0.03%, but Google rates the underlying Chromium severity as High.

Technical ContextAI

The vulnerability lives in ANGLE (Almost Native Graphics Layer Engine), the abstraction layer Chrome uses to translate OpenGL ES API calls into the platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). ANGLE runs partially in the GPU process, which historically has weaker sandboxing than the renderer process, making it a frequent pivot point for sandbox escapes. Although the NVD entry lists CWE as N/A, the 'Buffer Overflow' tag and the out-of-bounds read/write description align with CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read), classic memory safety defects in C++ graphics code. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop builds prior to the fixed Stable channel release.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 on the Stable desktop channel - install it via Chrome's built-in updater or push it through enterprise management (Google Admin console, Intune, Jamf, GPO) and force a browser restart so the new binary actually loads. Operators of Chromium-derived browsers should track their vendor's release notes and apply the equivalent merged build of Edge, Brave, Opera, Vivaldi, or Electron-based apps as soon as available. There is no documented runtime workaround, but as compensating controls until patching completes you can disable hardware-accelerated GPU rendering via the --disable-gpu flag or the chrome://settings 'Use hardware acceleration when available' toggle to reduce ANGLE exposure (trade-off: noticeable performance loss for video, WebGL, and canvas-heavy sites), and block or filter access to untrusted web content via secure web gateway policy. Reference advisories: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, https://issues.chromium.org/issues/511719039, and https://nvd.nist.gov/vuln/detail/CVE-2026-9975.