What is the CVSS score of EUVD-2026-33185?

EUVD-2026-33185 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33185?

Google Chrome on Windows users face a sandbox escape risk that could enable full system compromise if exploited as part of a targeted attack chain.. A patch is available.

How to fix or mitigate EUVD-2026-33185?

Within 24 hours: Inventory Windows systems running Chrome and categorize by user criticality. Within 7 days: Deploy Chrome 148.0.7778.216 or later via your patch management system to all Windows endpoints. Within 30 days: Confirm 100% deployment completion and enable automatic Chrome updates to reduce future exposure.

Google Chrome EUVD-2026-33185

| CVE-2026-9890 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-5whj-qq2v-9wmc

Use After Free Memory Corruption Google Microsoft Denial Of Service Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:33 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page targeting the XR (WebXR) component. The flaw is a use-after-free rated Critical by Chromium and CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C); no public exploit identified at time of analysis and EPSS is low at 0.03%, but the bug forms a key link in a multi-stage browser exploit chain.

Technical ContextAI

The vulnerability resides in Chrome's XR subsystem, which implements the WebXR Device API for virtual and augmented reality experiences inside the renderer and broker processes. The root cause is CWE-416 (Use After Free): an object in the XR code path is freed while a dangling reference remains reachable, allowing the attacker to reuse the slab with attacker-controlled data and hijack control flow when the stale pointer is dereferenced. Because XR-related IPC and shared resources cross the renderer/sandbox-broker boundary, a UAF here is particularly dangerous: it provides a primitive that can be wielded from an already-compromised renderer against a more privileged process, enabling sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the Windows build line being explicitly named in the advisory.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 for Windows - update immediately via Chrome's built-in updater (chrome://settings/help) or by redeploying the latest MSI through your management tooling, and restart the browser to load the patched binary. Enterprises managing fleets should confirm the Stable channel pin is current and audit endpoints for stuck updates using the Chrome Browser Cloud Management console or equivalent EDR telemetry. If patching must be deferred briefly, a targeted compensating control is to disable WebXR by setting the WebXRImmersiveArEnabled and related WebXR enterprise policies to disabled, or by toggling chrome://flags/#webxr off - this removes the attack surface at the cost of breaking VR/AR web experiences, but does not mitigate other renderer-to-sandbox vectors so it is not a substitute for the patch. Reference the official advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html.