What is the CVSS score of EUVD-2026-33197?

EUVD-2026-33197 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33197?

A high-severity vulnerability in Google Chrome could allow attackers to escape the browser's security sandbox and access the wider system if they have already compromised the browser.. A patch is available.

How to fix or mitigate EUVD-2026-33197?

Within 24 hours: Identify all systems running Chrome versions prior to 148.0.7778.216 and prepare patch deployment packages. Within 7 days: Deploy Chrome 148.0.7778.216 or later across all affected systems, coordinating rollout with business units. Within 30 days: Verify complete deployment through device inventory systems and document remediation completion.

Google Chrome EUVD-2026-33197

| CVE-2026-9902 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-jmfp-wcf2-3h67

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:36 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Accessibility in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Accessibility component. Chromium rates the issue High severity and a vendor patch is available, though no public exploit identified at time of analysis and EPSS exploitation probability is currently low (0.03%, 11th percentile).

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's Accessibility subsystem, which exposes the DOM and rendering tree to assistive technologies and runs partly inside the sandboxed renderer with IPC bridges to higher-privileged browser-process components. Use-after-free conditions occur when memory is freed but a dangling pointer is later dereferenced, allowing an attacker to reclaim that allocation with attacker-controlled data and corrupt object state - in this case across the renderer/browser trust boundary, enabling sandbox escape. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds before 148.0.7778.216 as tracked in Chromium issue 498205735.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 or later - update Chrome Stable via the built-in updater or by redeploying the MSI/PKG package and force a restart so the new binaries take effect (Chrome will not apply the fix until relaunch). Administrators managing fleets via group policy or MDM should push the update and verify chrome://version reports 148.0.7778.216+, and downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) and Electron-based apps must be updated separately once their vendors rebase. If patching must be delayed, compensating controls include disabling renderer-process risky surface by enforcing Site Isolation (already default), restricting browsing to a known-good allowlist via enterprise policy, and disabling accessibility features for users who do not need them via the AccessibilityImageLabelsEnabled and related policies - note this degrades usability for assistive-technology users and does not fully eliminate the attack surface. Reference advisories: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and https://issues.chromium.org/issues/498205735.