What is the CVSS score of EUVD-2026-33220?

EUVD-2026-33220 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-33220?

Google Chrome versions prior to 148.0.7778.216 contain a sandbox escape vulnerability (CVE-2026-9925, CVSS 8.3) that enables attackers who have compromised the renderer process to break out of…. A patch is available.

How to fix or mitigate EUVD-2026-33220?

Within 24 hours: Inventory Chrome versions across all managed endpoints and identify instances running versions prior to 148.0.7778.216. Within 7 days: Deploy Chrome 148.0.7778.216 or later through your standard patch management process. Within 30 days: Verify complete deployment and audit for any remaining instances on vulnerable versions.

Google Chrome EUVD-2026-33220

| CVE-2026-9925 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-9ggg-9fq9-qxvg

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:39 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 enables remote attackers, who have already compromised the renderer process, to break out of the browser sandbox via a use-after-free flaw in the ANGLE graphics translation layer. Exploitation requires user interaction (visiting a crafted HTML page) and a prior renderer compromise, making this a second-stage primitive in a chained attack. EPSS is low at 0.03% and there is no public exploit identified at time of analysis, though Google rates the underlying Chromium severity as High.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform abstraction that translates WebGL and other OpenGL ES calls into the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). It runs partially within the GPU process, which is more privileged than the heavily-sandboxed renderer process, making it a frequent target for sandbox escapes. The root cause is CWE-416 (Use After Free): memory is referenced after it has been freed, allowing an attacker who controls heap layout to substitute attacker-controlled data into the freed object, which is then dereferenced - typically yielding type confusion, arbitrary read/write, or control-flow hijack across the renderer/GPU process boundary.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - update Chrome via Help > About Google Chrome or by ensuring the auto-update service is running, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, push the updated MSI/PKG/DEB through your endpoint management platform and verify version 148.0.7778.216 or later is installed. Track downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) for their merge of the fix and update accordingly. As a temporary compensating control before patching, you can disable WebGL via the chrome://flags or enterprise policy (HardwareAccelerationModeEnabled=false, or blocking WebGL via the WebGL2Enabled / 3DAPIs policy), which removes the primary path into ANGLE - trade-off is broken rendering for any site using WebGL, hardware-accelerated canvas, or 3D content.