PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9993 Google CVE debrief

A use-after-free vulnerability in Google Chrome's Views component, present in versions prior to 148.0.7778.216, enables a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox by tricking a user into opening a crafted PDF file. The Chromium security team rates this flaw as High severity. The vulnerability was published in the NVD on 2026-05-28 and last modified on 2026-05-29. No known exploitation in ransomware campaigns has been documented, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with large Chrome deployments, enterprises handling sensitive PDF documents, and security teams defending against advanced persistent threats that employ multi-stage browser exploitation chains. The sandbox escape potential makes this particularly relevant for environments where browser isolation is a key security control.

Technical summary

The vulnerability exists in Chrome's Views UI framework where a use-after-free condition can be triggered during PDF rendering. An attacker who has already achieved code execution in the renderer process (the least-privileged sandbox) can leverage this flaw to corrupt memory in a way that escapes the sandbox and executes code with higher privileges. The attack vector requires user interaction (opening a malicious PDF) and builds upon an initial renderer compromise, chaining multiple exploitation stages. The fix in Chrome 148.0.7778.216 addresses the underlying memory management defect in Views.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Google Chrome to version 148.0.7778.216 or later on all supported platforms (Windows, macOS, Linux).
  • Verify automatic update policies are enabled and functioning for managed Chrome deployments.
  • Restrict or block untrusted PDF attachments at email gateways and web proxies until patching is complete.
  • Monitor for unexpected renderer crashes or sandbox escape attempts as potential exploitation indicators.
  • Review endpoint detection rules for anomalous Chrome child process behavior, especially unexpected privilege elevation.

Evidence notes

The CVE description identifies the root cause as a use-after-free (CWE-416) in Views. CPE data confirms affected products are Google Chrome builds earlier than 148.0.7778.216 on Windows, macOS, and Linux. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a base score of 8.3, reflecting high impact but requiring user interaction and an initial renderer compromise. Vendor release notes and the Chromium issue tracker are cited as authoritative sources.

Official resources

2026-05-28T23:16:57.530Z