What is the CVSS score of CVE-2026-9117?

CVE-2026-9117 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9117?

Google Chrome versions before 148.0.7778.179 on Linux and ChromeOS contain a sandbox escape vulnerability (CVE-2026-9117) that could allow attackers to break browser isolation and access system…. A patch is available.

How to fix or mitigate CVE-2026-9117?

Within 24 hours: Identify all Chrome deployments on Linux and ChromeOS systems; determine which are business-critical or exposed to untrusted content. Within 7 days: Deploy Chrome 148.0.7778.179 or later across all affected systems using your standard patch management process; verify auto-update is enabled if not using centralized deployment. Within 30 days: Confirm 100% patch deployment completion via inventory audit.

Google Chrome CVE-2026-9117

EUVD-2026-31165 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-20 Chrome

GHSA-8m69-p3vj-fhqc

Information Disclosure Google Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:31 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome (Linux and ChromeOS) prior to 148.0.7778.179 allows a remote attacker who has already compromised the renderer process to break out via a crafted video file processed by the GFX component. The flaw is a type confusion (CWE-843) rated High severity by Chromium, with no public exploit identified at time of analysis and SSVC indicating exploitation has not been observed. It requires user interaction and chained exploitation of a prior renderer compromise, which raises the bar despite the High CVSS of 7.5.

Technical ContextAI

The vulnerability resides in Chrome's GFX (graphics) subsystem, which handles media and rendering operations, including video decoding pipelines invoked when the browser processes container/codec data. The root cause is CWE-843 (Access of Resource Using Incompatible Type - Type Confusion), where an object of one type is interpreted as another, leading to memory operations using a mismatched layout and ultimately to controllable code execution paths. In Chrome's multi-process model, GFX-related processing can straddle renderer and GPU/utility boundaries, and a type confusion here is leveraged as the second link in an exploit chain: the attacker already controls the sandboxed renderer and uses the crafted video to corrupt state in a more privileged process, achieving a sandbox escape. CPE coverage is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD specifying Chrome versions below 148.0.7778.179.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.179 - upgrade Chrome on Linux and ChromeOS to 148.0.7778.179 or later via the standard auto-update channel, verifying via chrome://settings/help and restarting the browser to apply, as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. For managed fleets, push the update through enterprise management (Chrome Browser Cloud Management or ChromeOS device policy) and confirm rollout via reporting. Until updates are deployed, compensating controls include enforcing Site Isolation (already default), enabling enhanced Safe Browsing to reduce delivery of malicious media, restricting autoplay and untrusted media via policy (AutoplayAllowed=false, URLBlocklist for untrusted domains hosting media), and considering temporary use of an alternative browser for high-risk users - note these reduce but do not eliminate exposure since user-clicked video content can still trigger processing, and overly broad URL blocklists may break legitimate workflows.