CVE-2026-9937

chromium-browser: Use after free in UI

View on CVE.org
Published May 28, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Description
Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

A use‑after‑free flaw in Chrome’s UI on Windows allows an attacker who has compromised the renderer process to escape the browser sandbox, a high‑severity vulnerability classified as CWE‑416 and CWE‑825.

Affected Systems

Google Chrome on Windows, with versions older than 148.0.7778.216, is affected.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity, while the EPSS score of <1% suggests exploitation is rare as of now. The vulnerability is not listed in CISA KEV. The attack vector requires a prior compromise of the renderer process, most likely via a malicious HTML page delivered by a remote site. If exploited, the attacker could gain privileges on the host system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 148.0.7778.216 or newer.
  • Disable third‑party extensions and reduce JavaScript exposure on untrusted sites to limit renderer privileges.
  • Use Chrome’s Safe Browsing and restrict file downloads, and consider disabling remote debugging if available.

Generated by OpenCVE AI on May 29, 2026 at 16:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6316-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
Title Use‑After‑Free in Chrome UI May Enable Renderer Sandbox Escape on Windows chromium-browser: Use after free in UI
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important
Type Values Removed Values Added
Title Use‑After‑Free in Chrome UI May Enable Renderer Sandbox Escape on Windows
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
May 30, 2026, 3:56 AM
Reserved
May 28, 2026, 5:24 PM

View source JSON

Updated
May 29, 2026, 2:41 PM

JSON

Status
Analyzed
Published
May 28, 2026, 11:16 PM
Modified
Jul 21, 2026, 11:10 AM

View source JSON

Severity
Important
Public date
May 27, 2026, 12:00 AM

View source Bugzilla JSON

Updated
May 29, 2026, 4:30 PM

JSON