What is the CVSS score of CVE-2026-9907?

CVE-2026-9907 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9907?

Yes, a patch is available for CVE-2026-9907. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-9907

EUVD-2026-33202 MEDIUM

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-mv3r-5x8j-pmcc

Buffer Overflow Information Disclosure Google Microsoft

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:24 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 4.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in Dawn in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Dawn WebGPU implementation on Windows affects all versions prior to 148.0.7778.216. The out-of-bounds read (CWE-125) in the Dawn graphics layer allows remote unauthenticated attackers to exfiltrate cross-origin data by enticing a user to visit a crafted HTML page, exploiting improper buffer boundary enforcement during GPU operations. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.03% (11th percentile) indicates very low automated exploitation likelihood, consistent with the moderate CVSS 4.3 score and required user interaction.

Technical ContextAI

Dawn is Google's open-source, cross-platform implementation of the WebGPU and WebGL graphics APIs, integrated into Chromium as the GPU abstraction layer for hardware-accelerated rendering. CWE-125 (Out-of-bounds Read) identifies the root cause as reading memory past the end of an allocated buffer within Dawn's graphics processing pipeline. On Windows, this class of vulnerability in a GPU context can expose memory contents across security origins - potentially leaking fragments of data belonging to other web origins or browser process state. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the vulnerability explicitly scoped to the Windows platform per the CVE description. The 'Buffer Overflow' tag present in the intelligence metadata is a misnomer - CWE-125 is a read-only out-of-bounds operation, not a write, which meaningfully constrains exploitation potential relative to a true buffer overflow.

RemediationAI

Upgrade Google Chrome on Windows to version 148.0.7778.216 or later, as detailed in the Chrome Stable Channel Update advisory (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Chrome's built-in auto-update mechanism should deliver this patch automatically; users can verify their version by navigating to chrome://settings/help and triggering a manual update check. For enterprise environments, deploy the update via Google Admin Console or Chrome Browser Cloud Management. As a temporary compensating control pending patching, WebGPU access can be restricted via the Chrome enterprise policy or by setting the flag chrome://flags/#enable-unsafe-webgpu to disabled - note this will break any WebGPU-dependent web applications or games. Proxy-based URL filtering to restrict browsing to known-trusted domains reduces the likelihood of encountering a crafted exploit page, though this is not a substitute for patching.