Google Chrome CVE-2026-9111

Victim must be running Google Chrome on Linux at a version prior to 148.0.7778.179 and must visit attacker-controlled HTML in that browser (UI:R - user interaction required). The vulnerable code path is in WebRTC, so the malicious page must invoke WebRTC APIs (e.g., RTCPeerConnection), meaning environments where WebRTC is disabled by enterprise policy are not exposed. No authentication is required against the victim (PR:N), the attack is network-reachable, and exploitation is constrained by Chrome's renderer sandbox - code execution lands inside the sandboxed renderer, so escape to the host requires an additional vulnerability. Platforms other than Linux are not in scope per the description.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction (loading a malicious page) and yields total compromise of the renderer process within the same security scope. CISA SSVC contradicts the high CVSS score in one respect: Exploitation is rated 'none' and Automatable is 'no', meaning no active exploitation has been observed and mass-automation is not currently feasible, while Technical Impact is 'total'. EPSS and KEV data were not provided in the input, so probabilistic exploitation likelihood and CISA KEV listing cannot be confirmed here. Practically, browser use-after-free bugs in WebRTC have historically been chained with sandbox escapes to achieve full RCE - the renderer sandbox is a meaningful mitigation that this CVE alone does not bypass - so prioritization should be high for Linux fleets but framed as 'patch promptly' rather than 'actively exploited emergency'.

An attacker hosts a malicious HTML page that initiates a WebRTC PeerConnection and crafts SDP or RTP traffic patterns that trigger the use-after-free in the renderer; the victim is lured via phishing, malvertising, or a watering-hole compromise, and simply visiting the page in vulnerable Chrome on Linux causes the dangling pointer to be reused with attacker-controlled data, yielding code execution inside the renderer sandbox. No public exploit is identified at time of analysis, and full compromise of the host would typically require chaining with a separate sandbox escape.