What is the CVSS score of CVE-2026-9123?

CVE-2026-9123 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-9123?

A critical code execution vulnerability in Chrome's Chromecast functionality on Android, Linux, and ChromeOS systems (CVE-2026-9123) affects organizations with these endpoints, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-9123?

Within 24 hours: Inventory all Chrome deployments across Android, Linux, and ChromeOS systems to determine organizational scope. Within 7 days: Deploy Chrome version 148.0.7778.179 to all affected endpoints through your standard patch management process. Within 30 days: Verify 100% deployment completion and conduct spot-checks to confirm no systems remain on pre-148.0.7778.179 versions.

Google Chrome CVE-2026-9123

EUVD-2026-31170 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-20 Chrome

GHSA-q8x9-c3xr-45r5

RCE Buffer Overflow Google Heap Overflow

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 22:31 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

May 20, 2026 - 20:02 EUVD

CVE Published

May 20, 2026 - 19:12 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Heap buffer overflow in the Chromecast component of Google Chrome on Android, Linux, and ChromeOS prior to version 148.0.7778.179 allows an adjacent-network attacker to execute arbitrary code within the renderer sandbox via malicious network traffic. Google's Chrome team reported the issue with a Medium severity rating, and no public exploit identified at time of analysis. The vulnerability requires adjacent network positioning rather than full internet-based access, limiting practical exploitation to attackers on the same local network segment.

Technical ContextAI

The vulnerability resides in Chromecast functionality embedded in Google Chrome, which handles device discovery and media casting over local networks using protocols such as mDNS and DIAL. CWE-122 (Heap-based Buffer Overflow) indicates that parser code processing untrusted network input writes beyond the allocated heap region, corrupting adjacent memory structures. The affected CPE (cpe:2.3:a:google:chrome) confirms this affects the Chrome browser application across Android, Linux, and ChromeOS platforms. Exploitation occurs within Chrome's sandbox, which constrains the immediate impact but provides a foothold that could be chained with a sandbox escape for full system compromise.

RemediationAI

Vendor-released patch: 148.0.7778.179 - upgrade Chrome to this version or later on Android, Linux, and ChromeOS via the standard auto-update channel or platform-managed update mechanisms, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html. Confirm the update by checking chrome://settings/help after restart. As a compensating control until patching completes, administrators can restrict Chromecast functionality by disabling media routing via the MediaRouterEnabled enterprise policy set to false, which prevents the vulnerable code path from processing untrusted casting traffic at the cost of disabling all cast-to-device features. Network-level mitigation includes isolating untrusted devices from segments where Chrome users operate, since the adjacent-network attack vector requires the attacker to share a broadcast domain.