What is the CVSS score of EUVD-2026-33184?

EUVD-2026-33184 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33184?

Google Chrome on Android versions prior to 148.0.7778.216 contain a sandbox escape vulnerability enabling remote attackers to break out of the browser security boundary through a crafted webpage,…. A patch is available.

How to fix or mitigate EUVD-2026-33184?

Within 24 hours: Inventory Chrome on Android versions across organization and verify automatic updates are enabled. Within 7 days: Deploy Chrome version 148.0.7778.216 or later via MDM to all managed devices. Within 30 days: Confirm 95%+ patch compliance and document deployment timeline.

Google Chrome EUVD-2026-33184

| CVE-2026-9889 HIGH

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-gf8f-g97g-h982

Google Information Disclosure Buffer Overflow Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:32 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker to break out of the renderer sandbox by serving a crafted HTML page that triggers an out-of-bounds read and write in the Dawn WebGPU implementation. Chromium rates the underlying issue as Critical severity, and CVSS 8.3 with scope change reflects the cross-boundary impact, though EPSS is low at 0.03% and no public exploit has been identified at time of analysis.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU API, providing GPU acceleration for web content by translating WebGPU calls into native graphics backends (Vulkan, Metal, D3D12). Because Dawn parses and dispatches GPU commands originating from untrusted JavaScript in the renderer, memory-safety defects in its command validation or buffer handling can be reached directly from a web page. The root cause class is CWE-125 (out-of-bounds read) combined with an out-of-bounds write, which in the context of a GPU process - a higher-privileged broker than the renderer - enables escape from the renderer sandbox (CVSS scope-changed). The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the description specifically scoping the impact to the Android build.

RemediationAI

Vendor-released patch: Google Chrome for Android 148.0.7778.216 - update via the Google Play Store or managed Android update channel, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, push the update through Android Enterprise / MDM and verify the version post-rollout. As a compensating control until devices are patched, disable WebGPU via the chrome://flags '#enable-unsafe-webgpu' and '#enable-webgpu-developer-features' settings or an enterprise policy that prevents WebGPU usage; the trade-off is loss of GPU-accelerated web features (3D content, ML inference in the browser) but Dawn is the specific attack surface and disabling it removes the exposed code path. Restricting web browsing to trusted sites via mobile content filtering reduces the chance of encountering a malicious crafted HTML page, at the cost of normal browsing utility.