What is the CVSS score of EUVD-2026-33169?

EUVD-2026-33169 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33169?

Google Chrome versions prior to 148.0.7778.216 contain a critical sandbox escape vulnerability (CVE-2026-9874, CVSS 9.6) that allows remote attackers to compromise endpoints through crafted webpages.. A patch is available.

How to fix or mitigate EUVD-2026-33169?

24 hours: Inventory Chrome deployments across all endpoints and prepare patch distribution; notify users to exercise caution with untrusted websites during transition. 7 days: Deploy Chrome 148.0.7778.216 or later to all organizational endpoints and confirm installation on 95%+ of devices. 30 days: Achieve 100% patch deployment; conduct security audit for exploitation attempts.

Google Chrome EUVD-2026-33169

| CVE-2026-9874 CRITICAL

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-wv87-9xgv-7mrw

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:29 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

9.6 (CRITICAL)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

CRITICAL 9.6

DescriptionNVD

Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker to exploit a use-after-free condition in the Dawn WebGPU implementation through a crafted HTML page, leading to potential escape from the browser's renderer sandbox. The flaw carries a CVSS 9.6 with scope change reflecting cross-boundary impact, and while no public exploit identified at time of analysis, Google's own classification of the underlying Chromium severity as Critical signals significant risk to end users. EPSS is currently low (0.03%, 11th percentile), suggesting no widespread exploitation has been observed yet despite the severity.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing a cross-platform abstraction layer over native graphics APIs (Vulkan, Metal, D3D12). It runs partly in the GPU process, which sits outside the renderer sandbox boundary, making memory corruption bugs in this component particularly dangerous for sandbox escape scenarios. CWE-416 (Use After Free) occurs when memory is referenced after it has been freed, allowing an attacker to manipulate the freed allocation - often by controlling reallocation contents - to hijack control flow, leak data, or corrupt adjacent state. In the context of Dawn, malicious WebGPU shader or command sequences from a crafted HTML page can trigger object lifetime mismanagement to break out of normal renderer isolation. The affected CPE is cpe:2.3:a:google:chrome (all versions prior to the fix).

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade Stable channel desktop installations to this version or later via Chrome's auto-update mechanism, verified at chrome://settings/help, and restart the browser to load the fix; the official advisory is at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise administrators should validate their managed update channel and force-deploy via group policy where auto-update is disabled, and downstream Chromium-based browser users (Edge, Brave, Opera, Electron apps) should track their respective vendors' rebase advisories. As a temporary compensating control before patching, WebGPU can be disabled via the chrome://flags/#enable-unsafe-webgpu setting (set to Disabled) or by enterprise policy, which removes the attack surface in Dawn at the cost of breaking sites that depend on WebGPU-accelerated graphics or compute; alternatively, browsing untrusted sites only in a hardened/isolated environment until patching completes reduces exposure.