What is the CVSS score of CVE-2026-9115?

CVE-2026-9115 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9115?

Yes, a patch is available for CVE-2026-9115. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9115

EUVD-2026-31161 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-20 Chrome

GHSA-hpcc-6fhx-pp2m

Authentication Bypass Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:36 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.3 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's Service Worker subsystem (all versions prior to 148.0.7778.179) allows remote unauthenticated attackers to read cross-origin data by luring a victim to a crafted HTML page. The flaw originates from insufficient policy enforcement (CWE-693) within the Service Worker layer, enabling unauthorized access to confidential data across origins. No public exploit code has been identified and no active exploitation is confirmed; Google has shipped a fix in stable channel version 148.0.7778.179.

Technical ContextAI

Service Workers are background scripts registered by web pages to intercept and handle network requests, operating under strict same-origin policy (SOP) constraints that prevent cross-origin data access. CWE-693 (Protection Mechanism Failure) identifies the root cause as an inadequate enforcement of these SOP boundaries within Chrome's Service Worker implementation, potentially allowing a maliciously crafted Service Worker to intercept or relay responses originating from a different origin than the one that registered it. The affected product scope is defined by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all platform variants of Google Chrome before version 148.0.7778.179, as confirmed by ENISA EUVD-2026-31161.

RemediationAI

Update Google Chrome to version 148.0.7778.179 or later, which contains the vendor-released fix as announced in the stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Chrome typically performs automatic background updates, but administrators managing enterprise deployments should verify installed versions via fleet management tooling and force-push the update if auto-update is disabled or delayed. If immediate patching is not operationally feasible, restricting end-user access to untrusted or external web content via URL filtering or enterprise browser policy (e.g., Chrome Enterprise's URLBlocklist policy) reduces exposure, though this imposes usability trade-offs and should be treated as a temporary measure only until patching is complete.