CVE-2026-9886
A critical flaw in Google Chrome on macOS lets a remote attacker escape the browser sandbox by loading a specially crafted HTML page. The bug is a use‑after‑free in the Base component and can give attackers full control over the victim’s system. Updating Chrome to version 148.0.7778.216 or later removes the vulnerability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome on macOS versions earlier than 148.0.7778.216.
Real-world impact
An attacker could use a malicious web page to escape the browser sandbox and run arbitrary code on the victim’s computer, potentially taking full control of the system.
Why this severity
The CVSS score of 9.6 reflects the high impact of complete compromise of confidentiality, integrity, and availability, combined with the fact that the flaw can be exploited remotely with no user interaction beyond opening a malicious page.
What to do about it
- 01Upgrade Google Chrome to version 148.0.7778.216 or later.
- 02Restart the browser.
NVD description indicates fix in Chrome 148.0.7778.216 or later.
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/05/stable-channel-upda…release notes
- issues.chromium.org/issues/508456788permissions required