What is the CVSS score of EUVD-2026-33183?

EUVD-2026-33183 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33183?

Google Chrome for Android versions prior to 148.0.7778.216 contain a high-severity sandbox escape vulnerability (CVE-2026-9888, CVSS 8.3) that could enable device compromise through escalation…. A patch is available.

How to fix or mitigate EUVD-2026-33183?

Within 24 hours: Inventory all Android devices using Chrome and document current versions. Within 7 days: Deploy Chrome for Android version 148.0.7778.216 or later through mobile device management or direct user notification. Within 30 days: Verify patch deployment across all Android devices and establish monitoring for exploitation attempts.

Google Chrome EUVD-2026-33183

| CVE-2026-9888 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-7q3p-9hf2-3vxw

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:32 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in WebView in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android versions prior to 148.0.7778.216 enables a remote attacker who has already compromised the renderer process to break out of the sandbox via a use-after-free flaw in the WebView component. Chromium rates the severity as Critical, and a vendor patch is available; no public exploit identified at time of analysis and EPSS is very low (0.03%, 10th percentile), but the chained-exploit potential against mobile users makes prompt patching important.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's WebView on Android, the component that embeds Chromium's rendering engine inside Android apps and the Chrome browser itself. Use-after-free conditions arise when memory is freed but a dangling pointer continues to reference it, allowing an attacker who can reallocate the freed region with controlled data to manipulate object state, vtables, or function pointers. Because WebView code runs across the renderer and browser process boundary on Android, a UAF reachable from a renderer-supplied HTML page can be leveraged to corrupt structures handled by a more privileged process, enabling escape from the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome (Android builds prior to 148.0.7778.216).

RemediationAI

Upgrade Chrome for Android to vendor-released patch 148.0.7778.216 or later via Google Play; the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html) and the Chromium issue tracker entry (https://issues.chromium.org/issues/511715166) are the authoritative sources. For managed Android fleets, push the updated Chrome APK through MDM and verify the installed version. Where immediate patching is not possible, reduce risk of the prerequisite renderer compromise by enabling Enhanced Safe Browsing, restricting browsing to a vetted allowlist on high-risk devices, and discouraging use of in-app WebView for untrusted content - note that these controls degrade usability and do not directly close the UAF, so they are stopgaps until the update is applied.