What is the CVSS score of EUVD-2026-33125?

EUVD-2026-33125 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33125?

A high-severity remote code execution vulnerability in Google Chrome (CVE-2026-9983, CVSS 8.8) allows attackers to compromise employee and customer devices through malicious web pages requiring only…. A patch is available.

How to fix or mitigate EUVD-2026-33125?

24 hours: Inventory all Chrome deployments across organization (corporate devices, development environments, customer-facing services); communicate patch urgency to IT leadership. 7 days: Deploy Chrome 148.0.7778.216 or later via patch management system; verify automated updates are enabled and not suspended. 30 days: Validate 100% patching compliance through device inventory; review system logs and browser history for indicators of exploitation (crash dumps, unusual network activity from chrome processes).

Google Chrome EUVD-2026-33125

| CVE-2026-9983 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-28 Chrome

GHSA-2hwp-xj49-9v3j

Google Memory Corruption RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:22 vuln.today

CVSS changed

May 29, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page that triggers a type confusion bug in the Skia graphics library. The flaw was reported by the Chrome team and is rated High severity by Chromium; no public exploit has been identified at time of analysis, though browser type-confusion bugs in Skia have historically been weaponized. Exploitation requires user interaction (UI:R) - typically visiting an attacker-controlled or compromised page.

Technical ContextAI

Skia is the open-source 2D graphics library used by Chromium (and downstream browsers including Edge, Brave, Opera, and others) to render canvas, SVG, fonts, and compositor layers. CWE-843 (Access of Resource Using Incompatible Type, a.k.a. Type Confusion) means code treats an object as one type while it was actually allocated as another, allowing attacker-controlled data to be interpreted as pointers, vtables, or sizes. In Skia, type confusion typically arises in object lifecycle handling between SkPaint/SkPicture/SkImage structures or in deserialization paths, and is reachable from JavaScript through Canvas2D, WebGL, or CSS rendering APIs. The affected CPE (cpe:2.3:a:google:chrome) confirms upstream Chrome desktop builds; Chromium-based browsers will inherit the bug until they merge the corresponding Skia/Chromium fix.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 (Stable channel for desktop) - update immediately via the built-in updater or by redeploying the MSI/PKG/DEB package through enterprise management (Chrome Enterprise, Intune, Jamf, SCCM). Verify the running version under chrome://settings/help and force-relaunch since the patch only takes effect after browser restart. Administrators of Chromium-based browsers (Edge, Brave, Opera, etc.) should track those vendors' advisories and apply equivalent updates as they ship. If patching cannot be performed immediately, compensating controls include enabling Site Isolation (default in Chrome, verify via chrome://flags), restricting browsing to trusted sites via enterprise URL allowlists (trade-off: breaks general web usage), and disabling JavaScript on untrusted origins via the URLBlocklist/DefaultJavaScriptSetting policies (trade-off: significantly degrades modern web functionality). See the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium bug at https://issues.chromium.org/issues/513001309 (which may remain restricted until broader patch adoption).