What is the CVSS score of CVE-2026-9113?

CVE-2026-9113 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9113?

Yes, a patch is available for CVE-2026-9113. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9113

EUVD-2026-31163 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-20 Chrome

GHSA-7rqh-fgfv-43q2

Buffer Overflow Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:35 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.3 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory read in the GPU component of Google Chrome on macOS exposes process memory to remote attackers via a crafted HTML page. Affected versions are all Chrome releases prior to 148.0.7778.179 on Mac; Windows and Linux are not identified as affected. No public exploit or active exploitation has been identified at time of analysis, and SSVC confirms exploitation status as none with non-automatable attack delivery.

Technical ContextAI

The vulnerability is rooted in Chrome's GPU rendering subsystem on macOS, classified as CWE-125 (Out-of-Bounds Read). Chrome's GPU process is responsible for hardware-accelerated graphics operations, and a specially constructed HTML page can supply malformed rendering instructions that cause the GPU component to read beyond the boundaries of an allocated memory buffer. This class of vulnerability can expose adjacent process memory contents to the attacker. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD-2026-31163 specifying the vulnerable range as Chrome versions below 148.0.7778.179 on Mac. The GPU process boundary and macOS-specific code path narrow the scope relative to a cross-platform or browser-engine-level flaw.

RemediationAI

Update Google Chrome to version 148.0.7778.179 or later on macOS; this is the vendor-confirmed fix per the stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Chrome's automatic update mechanism handles this for most users, but enterprise administrators should verify deployment via fleet management tooling. If immediate patching is blocked, disabling GPU hardware acceleration in Chrome (chrome://settings/system, toggle off 'Use graphics acceleration when available') may reduce exposure by shifting rendering away from the affected GPU code path - the trade-off is degraded rendering performance and potential visual glitches on graphics-intensive sites. Restricting user navigation to known-trusted domains via browser policy (URL allowlisting) addresses the user-interaction prerequisite but is operationally impractical in most environments. Patching to 148.0.7778.179 remains the only definitive remediation.