What is the CVSS score of CVE-2026-9119?

CVE-2026-9119 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9119?

A heap buffer overflow in Chrome's WebRTC component creates a remote code execution risk for millions of users who access the browser to view crafted webpages.. A patch is available.

How to fix or mitigate CVE-2026-9119?

Within 24 hours: Notify all Chrome users that auto-updates must be enabled; disable any policies preventing patch installation. Within 7 days: Deploy Chrome 148.0.7778.179 or later to all managed endpoints via Group Policy, MDM, or distribution mechanisms; verify deployment completion through endpoint management tools. Within 30 days: Conduct full asset inventory audit to confirm 100% Chrome compliance with the patched version and document remediation for compliance records.

Google Chrome CVE-2026-9119

EUVD-2026-31167 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-20 Chrome

GHSA-fvfr-g27x-xw2m

RCE Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:32 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in the WebRTC component of Google Chrome before 148.0.7778.179 allows remote attackers to execute arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw was reported by Chrome's internal security team, has a patched stable channel build available, and carries a CVSS 8.8 score with no public exploit identified at time of analysis. SSVC currently rates exploitation as 'none' but technical impact as 'total', reflecting full compromise of the affected process if triggered.

Technical ContextAI

The vulnerability resides in WebRTC, the real-time communication stack embedded in Chromium that handles peer-to-peer audio, video, and data channel negotiation entirely from web content. The root cause is CWE-122 (heap-based buffer overflow), meaning that malformed input processed by WebRTC's media or signaling parsers writes past the bounds of a heap allocation, corrupting adjacent metadata or function pointers. Because WebRTC parses untrusted SDP, RTP/RTCP, and DataChannel payloads, an attacker-controlled HTML page can drive the parser into the vulnerable state. Per the CPE 'cpe:2.3:a:google:chrome:*' and EUVD affected-versions string, all Chrome desktop builds prior to 148.0.7778.179 are in scope.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.179 on the Stable channel - update immediately via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html and restart the browser to apply. In managed environments, push the update via Chrome Browser Cloud Management, Group Policy, or your MDM, and verify the running version on endpoints. If patching cannot be completed immediately, compensating controls include disabling WebRTC in enterprise policy (chrome://policy WebRtcEventLogCollectionAllowed / URLAllowlist constraints) - this breaks Google Meet, Teams web client, and any browser-based voice/video, so coordinate with collaboration owners - or restricting browsing to a vetted allowlist using SafeSearch/SmartScreen-equivalent proxies, which adds operational overhead but reduces exposure to untrusted HTML pages until patch deployment completes. For downstream Chromium browsers, track their respective vendor advisories for the corresponding fix version.