What is the CVSS score of EUVD-2026-33194?

EUVD-2026-33194 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33194?

Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability that could allow attackers who have already compromised the browser renderer process to break system isolation and gain…. A patch is available.

How to fix or mitigate EUVD-2026-33194?

Within 24 hours: Scan and inventory Chrome instances running versions older than 148.0.7778.216, grouped by department and criticality. Within 7 days: Deploy Chrome 148.0.7778.216 or later through standard patch management channels; prioritize development teams and security-sensitive roles first. Within 30 days: Verify minimum 95% coverage of patched Chrome versions across enterprise and retain deployment records for audit compliance.

Google Chrome EUVD-2026-33194

| CVE-2026-9899 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-7hf6-4wx4-wjxv

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:35 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High severity by Chromium with a CVSS score of 8.3, but EPSS exploitation probability is currently very low at 0.03% and no public exploit has been identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that converts OpenGL ES API calls into the native graphics API of the host platform (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). It runs partially inside the GPU process, which sits at a higher privilege tier than the sandboxed renderer process. The vulnerability is a CWE-416 use-after-free condition in ANGLE - memory is referenced after it has been freed, allowing an attacker who controls freed-object contents to corrupt program state. Because ANGLE bridges renderer and GPU processes, a UAF here is a classic vector for crossing the sandbox boundary. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update via Chrome's built-in updater or redeploy the fixed MSI/PKG from enterprise channels, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Restart the browser after update because Chrome only loads patched binaries on relaunch; enterprise admins should enforce a maximum relaunch interval via the RelaunchNotificationPeriod policy. For Chromium-based browsers, apply the corresponding vendor build once published. There is no practical configuration-only workaround for an ANGLE memory-corruption bug; partial compensating controls include disabling hardware acceleration via the HardwareAccelerationModeEnabled policy (which routes more rendering through software paths and may reduce ANGLE exposure but degrades performance and breaks WebGL/WebGPU workloads), or restricting WebGL access through site isolation and enterprise URL allowlisting, which limits which origins can reach the vulnerable code path at the cost of breaking legitimate 3D/graphics web apps.