CVE-2026-9887: Use after free in Proxy
Published May 8, 2026
·Updated
Chromium: CVE-2026-9887 Use after free in Proxy
Other sources
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC script. (Chromium security severity: Critical)
— NVD
Credit
Google
Affected Software
8 affected componentsFixes available
Google Google Chrome<148.0.7778.216
All of the following
Google Chrome<148.0.7778.216
Microsoft Windows
All of the following
Google Chrome<148.0.7778.215
Any of the following
Apple macOS
Linux Linux kernel
Microsoft Edge (Chromium-based)
Microsoft Edge<148.0.3967.96
Event History
May 28, 2026
CVE Published
via MITRE·10:25 PM
Data Sourced
via MITRE·10:25 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeaknessAffected Software
May 29, 2026
Data Sourced
via Microsoft·11:19 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·11:19 PM
DescriptionAffected Software
Jun 3, 2026
Data Sourced
12:00 AM
SeverityWeakness
Peer vulnerabilities
Found alongside the following vulnerabilities.