What is the CVSS score of CVE-2026-9122?

CVE-2026-9122 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9122?

Yes, a patch is available for CVE-2026-9122. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9122

EUVD-2026-31172 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-20 Chrome

GHSA-m56p-rp6v-288r

Buffer Overflow Information Disclosure Google

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:34 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in the GPU process of Google Chrome on macOS prior to 148.0.7778.179 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a crafted HTML page (CVSS UI:R), limiting automation potential - consistent with SSVC's 'Automatable: no' determination. No public exploit identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; Chrome's own severity rating is Medium.

Technical ContextAI

The vulnerability (CWE-125: Out-of-bounds Read) resides in Chrome's GPU process, a sandboxed component responsible for hardware-accelerated rendering operations including WebGL and canvas APIs. When processing a maliciously crafted HTML page, the GPU subsystem reads beyond the bounds of an allocated memory buffer, exposing data from the GPU process address space. On macOS, this process handles rendering state that may include sensitive content depending on browser activity. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD data confirming versions prior to 148.0.7778.179 are affected. The Mac-platform specificity is encoded in the CVE description rather than the CPE wildcards, so defenders should not rely on CPE alone for scoping.

RemediationAI

Upgrade Google Chrome on macOS to version 148.0.7778.179 or later, which contains the vendor-released patch per the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Enterprise administrators should enforce Chrome update policies via Google Admin Console or MDM solutions (e.g., Jamf, Kandji) to ensure timely deployment across Mac fleets. If immediate upgrade is not feasible, disabling hardware acceleration in Chrome (Settings → System → 'Use hardware acceleration when available') reduces GPU process attack surface at the cost of rendering performance and may cause visual degradation on complex pages. Blocking access to untrusted or unknown web content via proxy filtering can reduce exposure to crafted pages, though this does not eliminate risk from compromised legitimate sites.