What is the CVSS score of CVE-2026-9882?

CVE-2026-9882 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-9882?

Yes, a patch is available for CVE-2026-9882. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9882

EUVD-2026-33177 MEDIUM

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-qc83-g4w3-pxpq

Google Information Disclosure Red Hat Suse Chrome

Medium

Disputed · 6.5 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Red Hat

7.4 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

May 29, 2026 - 18:52 NVD

4.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

May 29, 2026 - 18:23 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 4.3

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics layer (prior to 148.0.7778.216) allows unauthenticated remote attackers to read sensitive cross-origin information by luring a victim to a crafted HTML page. The root cause is an integer overflow in ANGLE, Chrome's graphics translation engine, which is internally rated Critical by the Chrome security team despite a CVSS score of only 4.3. No public exploit has been identified at time of analysis, and the EPSS exploitation probability is very low at 0.03% (11th percentile), though the cross-origin data leakage class of vulnerability has historically attracted targeted exploitation in browser ecosystems.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the open-source library embedded in Google Chrome that translates OpenGL ES API calls to platform-native graphics APIs such as Direct3D on Windows, Metal on macOS, and Vulkan on Linux. An integer overflow in this layer can corrupt internal state used during rendering operations, potentially exposing memory contents or computed values that originate from cross-origin contexts - violating the browser's Same-Origin Policy at the graphics pipeline level. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to 148.0.7778.216. A notable data inconsistency exists: the NVD-assigned CWE is CWE-472 ('External Control of Assumed-Immutable Web Parameter'), which describes web parameter tampering and does not align with the 'integer overflow' root cause stated in the CVE description. The more appropriate CWE for the described flaw would be CWE-190 (Integer Overflow or Wraparound). This discrepancy should be verified against the vendor's upstream Chromium issue tracker (issues.chromium.org/issues/506375217).

RemediationAI

The primary remediation is upgrading Google Chrome to version 148.0.7778.216 or later, which includes the vendor-released patch for this vulnerability. Users should verify their Chrome version via chrome://settings/help and allow automatic updates to apply. The advisory is published at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For enterprise environments where immediate patching is not possible, a compensating control is to restrict access to untrusted or external websites using web filtering or proxy policies, reducing exposure to crafted HTML pages - note this approach is operationally disruptive and does not eliminate risk from compromised trusted sites. Disabling hardware-accelerated graphics (chrome://settings/system, toggle 'Use hardware acceleration when available') would remove the ANGLE code path but will significantly degrade rendering performance and is not recommended as a long-term measure. No workaround fully substitutes for the patch.