What is the CVSS score of CVE-2026-9121?

CVE-2026-9121 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9121?

Google Chrome versions prior to 148.0.7778.179 contain a vulnerability allowing attackers to execute code on user computers through malicious websites, exposing employee devices to data theft and…. A patch is available.

How to fix or mitigate CVE-2026-9121?

24 hours: Identify and catalog all Google Chrome deployments across corporate endpoints and determine current version levels. 7 days: Deploy Chrome version 148.0.7778.179 or later to all end-user systems via group policy, MDM, or automated patching tools, and verify successful installation across all systems. 30 days: Confirm 100% organizational compliance with the minimum patched version and implement automatic Chrome updates to prevent future exposure.

Google Chrome CVE-2026-9121

EUVD-2026-31171 HIGH

Out-of-bounds Read (CWE-125)

2026-05-20 Chrome

GHSA-mhhc-85f5-7chm

Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:30 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

8.8 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's GPU component prior to version 148.0.7778.179 allows remote attackers to exploit an out-of-bounds read via a crafted HTML page, potentially leading to arbitrary code execution or information disclosure within the renderer context. The flaw carries a CVSS 8.8 (High) rating due to network reachability and high impact across confidentiality, integrity, and availability, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis, and CISA SSVC marks exploitation status as 'none', suggesting opportunistic rather than active targeting.

Technical ContextAI

The vulnerability resides in Chrome's GPU process, which handles hardware-accelerated rendering for WebGL, Canvas, and compositing operations. CWE-125 (Out-of-bounds Read) indicates that the GPU component reads memory outside the bounds of an allocated buffer, which in browser GPU code typically arises from malformed shader inputs, texture parameters, or command buffer entries. While an OOB read alone leaks memory, Chrome's advisory explicitly notes the bug 'allowed a remote attacker to potentially exploit heap corruption,' implying the OOB condition can be chained into heap layout manipulation. The affected CPE (cpe:2.3:a:google:chrome) covers Chrome across platforms; the GPU process is sandboxed but compromise here is a known stepping stone toward full sandbox escape in chained Chrome exploits.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.179 or later, distributed via the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html and tracked in https://issues.chromium.org/issues/488064108. Users should ensure Chrome auto-update is enabled and restart the browser to apply; enterprise administrators should push the updated MSI/PKG via management tooling. As an interim compensating control, GPU acceleration can be disabled via chrome://settings ('Use hardware acceleration when available' off) or the --disable-gpu flag, which removes the vulnerable attack surface at the cost of degraded rendering performance and broken WebGL/Canvas-heavy sites. Chromium derivatives (Edge, Brave, Opera) should be updated to versions that incorporate the upstream fix once published by those vendors.